Less than two months ago, the crypto exchange Bybit fell victim to one of the largest attacks in the crypto sector’s history, losing about $1.5 billion in ether (ETH) to cyber criminals. While the leading trading platform has recovered significantly from the effects of the attack, market experts have analyzed data that showed how it navigated the incident.

A postmortem report obtained by the crypto institutional-grade research firm BlockScholes reveals how deeply the hack affected the broader crypto market, bid-ask spreads, and the role of Bybit’s new Retail Price Improvement (RPI) orders in the platform’s recovery.

How Bybit’s Hack Affected the Market

Recall that the attack targeted one of Bybit’s Ethereum cold wallets. BlockScholes disclosed that the sell-off that followed the incident was not unique to crypto because the market was already witnessing a significant de-risking across crypto assets due to several macro events, including tariff tensions and the launch of DeepSeek’s artificial intelligence (AI) model.

Analyzing the hack’s impact on spot trading volumes, analysts noted a short-lived spike in the hourly trade volume of all Tether (USDT) pairs away from the mean. After the spike, there was a significant drop in bitcoin (BTC) and altcoin trading volumes within the following days.

Bybit’s share in the spot trading volume market dropped from 11% to 4%, and the proportion of BTC traded fell from 50% to below 20%, while ETH volumes remained relatively stable. Although these volumes are yet to return to the high levels seen at the beginning of the year, there has been a significant recovery. The overall spot trading share has risen by a few points to 6-7%.

Despite the plunge in trading volumes, bid-ask spreads remained tight. This metric measures the difference between the lowest ask price and the highest bid price. A tighter spread indicates higher liquidity and lower execution risk.

Swift Recovery

After the hack on February 21, only Pepe (PEPE) and Official Trump (TRUMP) witnessed a significant change in order book depth; BTC and even ETH, the asset stolen during the attack, saw the lowest spreads, recording negligible changes after the incident. However, the order book depth of Bitcoin and Ethereum swiftly recovered within a week, a development attributed to Bybit’s RPI orders.

RPI orders aim to enhance liquidity exclusively for retail traders. The feature is a unique subset of orders placed by market makers or institutional participants that is open to only retail traders who manually interact with Bybit’s user interface.

Bybit introduced RPI orders on February 17, a few days before the hack. So, while the market tried to recover from the incident, there was a good depth of order books, deep liquidity pools, and tighter bid-ask spreads for retailers on Bybit.