Bybit + Glassnode: The Lazarus Hack and Market Resilience Report

In early 2025, the Lazarus exploit sent shockwaves through the crypto industry — triggering large-scale withdrawals, sharp price swings, and widespread market uncertainty. But unlike previous crises, the market held.In this joint report, Glassnode and Bybit provide a data-driven assessment of how digital asset markets responded to this structural shock. Using on-chain metrics, exchange data, and behavioral indicators, we unpack what made this event different — and what it tells us about the growing maturity of the ecosystem.Whether you’re a strategist, risk manager, or institutional allocator, this report offers a forensic look at real-time capital movements, investor behavior, and exchange resilience during one of the most critical inflection points of 2025.Digital Asset Market Resilience: A Structural View of the Bybit Lazarus HackThis report offers a rare data-driven view into how digital asset markets responded to one of the most disruptive events of 2025. Using Glassnode’s proprietary on-chain and exchange-level metrics, we examine the structural mechanics that helped contain systemic risk - and what this means for the future of institutional participation and platform resilience.What You’ll Learn in This Report:Bybit’s Ethereum Reserves and Derivatives Market RecoveryThe February 2025 hack that drained $1.4B in $ETH from Bybit marked the largest centralized exchange breach to date, temporarily reducing $ETH reserves from 779k to just 236k ETH. However, Bybit’s swift operational response led to a rapid recovery, with $ETH balances rebounding to a post-hack peak of 729k $ETH - restoring nearly 94% of lost reserves. This recovery played a central role in maintaining user trust and reflects the growing operational resilience of crypto platforms. Parallel to this, open interest across Ethereum, Bitcoin, and Solana derivatives experienced a sharp but short-lived contraction. By June, open interest not only recovered but surpassed pre-hack levels in $ETH and $SOL, signaling renewed investor confidence in Bybit’s infrastructure.Exchange Positioning: Market Share and Volume StabilityBybit’s derivatives market share, while briefly impacted, remained structurally sound. Open interest dominance dropped from 25% to a low of 18% after the hack but has since recovered to ~21%, underscoring partial restoration of market positioning.Perpetual volume dominance showed a similar trend, dipping from 17% to 14.3%, but rebounding to 16%. Despite these temporary losses in share, absolute trade volumes remained remarkably stable - averaging $10B/day for $BTC, $1.7B for $SOL, and peaking at a record $8.5B/day for $ETH, even though it was the primary asset affected in the breach. This stability indicates that while some market share shifted, overall trust in Bybit's trading engine and user experience persisted.Liquidity Stress and Risk Diagnostics: A Temporary ShockThe hack led to a clear but temporary deterioration in market liquidity. Bid-ask spreads widened and market depth across $BTC, $ETH, and $SOL fell sharply as market makers withdrew during peak uncertainty. However, by mid-Q2 2025, both metrics had fully normalized, with market depth even exceeding pre-hack levels - demonstrating a strong return of liquidity providers.Proprietary Glassnode indicators such as the Internal Reshuffling Ratio and Whale Withdrawal Ratio also spiked, reflecting internal asset restructuring and large-holder exits. Importantly, both normalized swiftly, signaling that operational disruptions were efficiently contained and did not escalate into systemic risk. Together, these metrics illustrate how the industry is evolving to withstand - and recover from - extreme stress scenarios without cascading failures.Discover more in the full reportExplore a real-world case study in exchange-level stress, institutional behavior, and capital flow mechanics under pressure. Learn how market participants responded, what on-chain and off-chain metrics revealed in real time, and what this event signals for the future of institutional crypto infrastructure.Download the full Glassnode x Bybit ReportGlassnode remains committed to providing the highest quality data and analysis to support institutional investors in the world of digital assets. Contact us for bespoke reports, data services, and more. For more reports on the current trends in the crypto markets, please visit Glassnode Insights.