Bybit cold-wallet breach: custody lessons for crypto users

In February 2025, Bybit disclosed that an attacker gained control of one of the exchange's cold wallets - offline storage that is supposed to represent the strongest line of defence against theft. The incident ranks among the largest exchange security failures in crypto history, with losses exceeding $1 billion in equivalent value.

Cold wallet labels and insurance funds do not replace the core rule: coins on an exchange are not fully yours. For USDT TRC-20 holders, the breach is a reminder to separate custody (where tokens sit) from fee optimisation (how you pay to move them).

What happened at Bybit

Bybit reported that a sophisticated attack compromised signing infrastructure connected to a cold wallet. Transaction details were publicly visible on Etherscan, confirming large outbound transfers from addresses Bybit later attributed to the breach.

The exchange activated emergency response protocols - including communications from leadership and commitments to back customer balances - but the event underscored that even tier-one venues with dedicated security teams remain single points of failure.

Users with funds still on Bybit faced a binary choice: trust the recovery plan, or withdraw to wallets they control while networks remained open.

Why "cold" did not mean "safe"

Cold storage only works when signing ceremonies, multi-party approvals, and operational access controls hold under adversarial pressure. An attacker who compromises the human or software layer that authorises cold transfers effectively owns the wallet - the hardware being offline does not help after signatures are forged.

Exchange custody concentrates risk: one successful breach affects every customer balance behind that vault. Self-custody distributes risk to individual key management - a different failure mode, but one you can mitigate with hardware wallets and seed phrase discipline.

Neither model is perfect. The lesson from Bybit is concentration: keeping life-changing balances on any single exchange exposes you to someone else's security incident.

Moving to non-custodial wallets

If you hold USDT TRC-20 on an exchange today, withdrawal to a non-custodial wallet is the first defensive step. Trust Wallet and TronLink are widely used TRON options with full TRC-20 support and local key storage.

Hardware wallets (Ledger paired with TronLink, ELLIPAL Titan) add a physical signing barrier for larger balances. The workflow changes - you confirm on device, you backup a seed phrase - but you remove exchange counterparty risk from the equation.

After withdrawal, sends still require Energy. That is where Profeex fits: delegate Energy at app.profeex.io so self-custody transfers cost ~2.73 TRX instead of burning 6.5 TRX - without returning funds to an exchange for convenience.

A practical checklist after the breach

Audit where your USDT and TRX actually live. Exchange screen balances are IOUs until you withdraw.

Enable hardware or air-gapped signing for amounts you cannot afford to lose. Store seed phrases offline - never in cloud notes or chat apps.

Pre-plan Energy before large withdrawal batches. Running out of resources mid-transfer is a common post-withdrawal stumble; Auto mode rules prevent that for active wallets.

Treat exchange deposits as temporary parking, not storage. The Bybit incident will not be the last custody failure in crypto - only the latest large one.