ByBit Founder: I Survived the $1.5B Hack and Still Had My Best Year | E168

The next dimension is really to become this one financial platform. In the future, the concept of bank, broker, crypto exchange all going to merge. One place where you can do all the things that money can do. Buying a stock, buying gold, buy cars, making investment. Anything it should be within one app.

End game.

To me, building trust at that critical stage of 1 week and also explain the journey of why we do certain things is probably where I should be spending my time. It shows that the company is well run. I go back to what should a CEO do.

Through this effort, it's not really the goal to calculate if I made a money or not because the money is already spent. So, this whole measurement is really to improve the efficiency and activation of the teams.

One of the things we find, all of the API infrastructure, it wasn't built for AI. So, for AI to connect to a Bybit API, it needs to make a lot of mistakes to figure out the most optimum way to use our product.

Maybe my Ethereum.

Well, I think it's not I think it's the industry that's been becoming more mainstream. I think ever since you start to see the trend changes that I think in 2017, 18 crypto exchange is really more trading focused. Whereas in the past few years, especially in the past 2 years, I think exchange is more or less becoming this one financial platform. And if you look at how the product evolve, the early days everyone only have derivatives. That's super trading focused. And then you have everyone focusing more on spot, which is more asset discovery. And then you start to see exchanges offering payment, card, earn product, which is more like a private banking earn even sophisticated earn product like dual asset like where you only getting in in private banking. So, with that the product line is really exploring expanding into retail banking. Like we are even offering retail banking feature now. Retail banking payments, cross-border payments, and many other things. So, I think it's all because the industry is evolved. Crypto is there to kind of really change how the financial system works. Because it's 24/7, it's global, it's cheaper. And it breaks barriers where you had certain financial choices, let's say in Nigeria, the financial product access you get is very different than someone from New York. Why? It's just because they live in different parts of the world. That was the issue before internet came along. But with internet, information stopped being segregated. Everyone gets same access of information whether you're in Iceland or in Vietnam. But because crypto is the money of internet, it's bringing that level of finance into this thing. And this is why tokenized asset is the new thing. RWAs is all based on the concept that there shouldn't be any barriers. It should be accessible as long as there's internet. So, I think that's kind of the industry's heading. And because of this whole background, we are becoming kind of the frontier of innovators that changing the financial industry and I guess that's why a lot of countries are embracing crypto and I get to meet with prime minister. It's a long answer.

I think it's typically the country will have a crypto framework and they would announce that they would view crypto as an innovation industry, as something that they want to promote and encourage. And then they want to meet some of the industry players and then we get a chance to meet. Otherwise, yeah, you won't get a chance, yeah. So, it's not really a Bybit play as per se. It's a crypto industry play.

Yeah, first foremost, you are representing the industry. And you are representing a voice of the industry. We are lucky enough, we are sizable enough that we can represent the industry. And I guess that's why we get to meet. And obviously, I think from the government perspective, they want to send out a signal that they are welcoming this industry. They see it as an opportunity and they want to attract more others like Bybit to their country. And I think that's why the meetings are happening, yeah.

I think it's different stages. The fun part in the first part is really be able to innovate and deliver product and then test the market. And now I think it's a different game that the industry requires a lot more compliance procedures that you need to be compliant first and that's where Bybit is heading towards. Yeah, believe it or not, we're probably one of the most compliant global exchange. We didn't have any issues with any government or any regulators. So, the game has changed and you realize the impact you are representing is different. Not only as a company, maybe sometimes you're representing an industry. I think they both is both fun. It's just initial stage is very product focused, you know, quick testing product and you get excitement because the market would welcome you if you have the right product. Now I think it's the impact you are making that are a lot more significant. And I feel it's also very fun. Because at the end of the day, why you do this whole thing? It's you want to make more impact, right?

I mean, if the critics is that, to be honest, I assume their assumption is I should be doing something else. But to me, building trust at that critical stage of 1 week and also explain the journey of why we do certain things is probably where I should be spending my time. And it shows that the company is well run. That I don't have to be stuck in the mundane daily operations. And I go back to what should a CEO do, right? A critical point. To me is wherever the company need me the most at that stage, I need to do that. Whether if at that point I need to be a PR person, I'll be the PR person. If at that point I need to be a support person, I'll be a support person. So, I think that's how I see it.

We are very healthy. We managed to actually last year was our highest achieved revenue year. We're not a public company, but just for everyone to know that around I think October, we already filled the hole of whatever we lost, and we in the end everyone got a bonus, and there was still a dividend. So actually we recovered rather fast. So the hack was I think February, right? So it took about 8 months to fill the hole with basically company profits. Company profit, everything filled. But your question is about dashboard. And whether you're indirectly hinting about the revenue, but the dashboard changed a lot. So we now use AI.

I give you example of how BI use it today within Bybit. So I would think previously before AI, everyone is eating a pre-cooked meal. If you imagine the business team of Bybit, like whether it's business development or growth product team or the country team in Brazil, they always have to they always been served a cooked meal as a certain template of a dashboard, whether it's Tableau or Datawind, and then it's filled, and every week they get the same data. And whatever they want to change a tiny little thing, they have to call the BI guy, and the BI guy does some changes, and they see it. So it's always pre-cooked. What with AI, everyone gets a kitchen. So what my BI team does now, I tell them you stop cooking. What you do is you provide material, but good materials. So the big data team, which works make sure they get all the fundamental data, build in the data points to collect all the data. My current BI team just package it and throw that into whichever business team. We create a MCP server for them, and in the order they want. Real-time.

Imagine a folder. If you are from Brazil country manager, let's say. You're my French country manager, you have now a folder, and all the data points you want, we will submit it based on your need, whether it's daily or hourly or whatever. You maybe you say, 'Okay, I have this new campaign. It's called 20% cashback for any French user that gets a Bybit card.' So I want to see how many user applies, the spending pattern, the cashback, how much cost, and then indirectly after they get a card, how much do they trade, and how much money we make. All of this data is now being submitted, and they just tell their like OpenClaw basically. They tell their claw to say, 'Generate this dashboard. I want to do this.' And if I don't like this dashboard, I change, and here's the data point. Here's my folder. Figure it out. And then the dashboard is kind of being created by themselves. So the data is raw, provided to each I mean, kind of raw. It's basically clean, right? It's being cleaned by BI. So the BI team now is just doing cleaning now instead of cooking. And they let the front-end team do the business team do does the cooking themselves. So they would provide the sort of data warehouse or data models, but then the business user would come, and basically the dashboard would be built by an AI because you say, 'I want to see this by...' The challenge is a lot of the business data they want is a combination of multiple data. Let's say French user during this campaign period, how many participated this event. French user means KYC equals French. Mika side for our regulator side. So there's multiple data points. So the BI job is to cook the data into a clean form, and then feed it to whatever the business need. So that's been a lot more efficient now. So it's pretty fun.

I use a lot. I use it on a daily basis. I play around with AI. So we actually since the launch of OpenClaw, the first thing I did was to tell my teams I need the enterprise version of this bloody thing. This is so good, right? And they were like, 'What? There's a lot of security issues, blah blah blah.' I said, 'I don't care. Figure it out.' So it was okay. So we created in our own We shouldn't be talking about this. Maybe I don't know. We'll get hacked. I don't know. We created our own I'm worried. Because there's a lot of security issues, but we actually wrote a sealed it. So we have our own internal servers that host these OpenClaw, and any information in and out is guarded by our security measurement. So and it can't really just learn a skill. It has to be approved by our security team, so a lot of things are ring-fenced. But yeah, so we managed to give every single employee a OpenClaw, and basically let them to play around with it. But you start to realize the challenge of AI is never the AI. It's how much data access the AI agent can get. So when you're talking about a enterprise level AI readiness, it's never how who can use pay for these subscription fees for Anthropic or OpenAI. It's never that because you pay okay, what they do? They just chat with it, right? It's just a better Google, right? But if you give it access to a lot of your internal infrastructure with API keys, essentially the ultimate version is that every single employee when they join, they get a API key, and that represents their identity. And whatever they can access, the AI should mimic it. So then within Salesforce, within the CRM, a lot of agent can do a lot of the manual work for the employee. So that's a kind of the ultimate version of the kind of the fundamental I think shift of AI infrastructure.

I think I've been playing around with it for a while. There is a moment I thought it's going to shift. There also a moment later I'll be like, 'Okay, this will make some efficient change, but not completely dramatically.' And I don't see it happening like I think a lot of company are laying off staff. We're not doing that. Because I haven't reached to the point I believe the AI actually is going to replace so many of my labor force. I also feel a lot of company is simply just laying off people, and they just use AI as excuse. The hard thing is how do you actually measure the AI output? And you can see the token spending within the company goes crazy. And in my mind, I'm like, 'Okay, how much actual efficiency saved do we get out of it?' You know? And that's always the hard part. So you need really a close loop to measure this efficiency. To me at this stage, I feel like what AI does is the introduction of Excel. Previously, we didn't have Excel. Now we have Excel. That's the dramatic change, but how dramatic change to each department, I will still trying to figure it out and measure it.

Yeah.

Oh, it's easy. Actually, that's the question I ask a lot of my marketing people when I hire them. And most people don't give me the clear answer. No, you have a very clear proposal before you commit to this thing. You measure all the asset you get. So with a Formula 1, it comes with how many races? 25 or whatever a year, right? And you divide into country. You go to the country manager, let's say for Japan. I have one year event. Who are we going to invite? How many tickets do we get? How many VIPs do we going to invite? How many affiliates or KOLs, let's say. If the KOL invite, how many posts they're going to post based on this event. And you measure the UV all together, right? And then how through the UV, how many became sign up? So how many become deposit? And then you have VIP users that you invite. You're just giving them show them a good time. But then you measure the retention afterwards, and their lifetime value after event like this. Although a lot of them it's hard to measure, but you still got to try. I think that's what we tell the teams. So you have all these things, but you also have intangible things where you have a potential business partner that you invite. Is the deal closed or not through this conversation we trace. But through this effort, it's not really the goal to calculate if I made a money or not because the money is already spent. Even if your result is not But through this access, I can measure if my team are really utilizing the asset well. And they will tell me, 'We invited 20 people to the Japan event. In the end, 10 was closed.' So for next year, I can say I want to close at like 60%. So this whole measurement is really to improve the efficiency and activation of the teams. And then you attribute probably 40% of it to branding. And the branding part you just is just share voice and typical things you just kind of attribute it because it's just hard to measure. But still there's a methodology you can try to do it.

The value we start to see is diminishes every year. Because you end up inviting the same people. This is a very honest truth. And then the same people would have expectation that they will get invited. If they don't get invited, there's actually damage to the business.

And then there's a whole activation team I need to sustain to maintain this whole process. Beginning of the year there's a whole giant roadmap of things that every single country need to fill area filling every VIP team. They need to calculate If you actually calculate the manpower you spend into acting with it is probably double the price.

Right it's much more. It's much more. If you want to do a good job. If you don't give a [__] and you just randomly give out tickets fine. But then as a business we have to do something about it, right? So we start to see the car the value diminish and the cost start to increase. If we're going to do another 3 year for sure we're not going to make the money. And also the branding effort I would discount it 50% because you're already been there for 3 years. You know the branding result maybe it's better to spend it in somewhere else. I don't know like a football or something. So that's kind of the logic.

The same. We run everything with numbers. So it's the EU team that brought it up. They see it was a good opportunity. We looked at the cost and then I said okay give me a proposal of how you're going to activate how am I going to measure the result? And the always the first three proposals you don't even look at it because they are completely [__]. It's just that the first proposal is always 'Ben this will increase our branding, we grow awareness.' I'm like no I don't want that [__]. Give me the numbers. Who you're going to invite? How are you going to activate? What's the activation look like, you know, and how much is the activation cost going to be? So gradually they refine the proposal and in the end it's actually a full on activation proposal with the number calculated. So every month we can review it. 10% progress. What was the result? Was it as good as 10% or was it 5% or half of it? That serves as a benchmark. If the team want me to ask for another sponsorship, I will be based on last sponsorship and the number you give me and the actual result, I would discount 50% you know, and this is how much other things.

I think I'm pretty involved in all aspect in say the countries that we have operation I'm involved in a bi-weekly basis. They will but the meetings are very fast. So let's say 15 minutes with each country. There's a fixed format. We look at the top numbers of the country, the channel performance and then the things they need support with so I can make quick decision. My job is really just to make decisions all day long. And because sometimes obviously I don't have to make decision but then the decision gets made rather slowly. If I don't step in So I would say I'm pretty hands-on and on all aspect I look at it. Which aspect I don't really look at? Like extremely mature teams I let them kind of For example our support team their OKRs is I look at them every quarter. The OKRs how are their SLAs achieved? How fast do they respond? But even with support there are issues like we are expanding in multiple jurisdictions and we work with local banks and the local banks are giving us a lot of [__] for let's say they just want to EDD our customers for no reasons. And when customer get EDD'd it means they made a deposit, they can do nothing with their money. They just get an enhanced due diligence. And they have to fill a bunch of questionnaire. It's like when you try to get a Bybit card and they will all of a sudden say where's your money come from? What's your address? What's your girlfriend's name? What's your dog's name? I don't know. It depends on which partner we work with. So then these things that comes up I need to help the team to get involved like okay, why are they asking? Can we if this have to be asked, can we simplify the process so our clients get a better user experience and all of that. So yeah whenever there's an issue up I will say pretty much I'm there.

I mean to be honest the whole security part and the tech part wasn't something I was fully on top of. I was more of on the business side a lot of things. And this is why afterwards I'm fully on top of the security things and making sure that and also there was a bit of a gap within the company I guess. You start to see that happens all the time. Scope of one department although it's called security it is very different company by company. The way we got hacked is because we used a third party wallet and that wallet got hacked. And in security scope and our own security scope at that time, they cover all the internal things. And they were like well external vendors they have thousands of external vendors and who select this external vendor was at the time which long time ago maybe finance team. They said let's use this wallet provider is we think it's they took a look and then kind of there was no constant monitoring and stuff. So yeah we changed the scope and making sure that is fully covered as long as it's our asset covers security would cover that. So yeah. So that was some of the scoping issues.

There's also no it the decision is made based on the counterparty I think. How much is the likelihood you get something out of it based on the energy you want to spend on it, right? When we looked at we obviously we considered suing Safe. We looked at Safe and the whole company doesn't have that much money. So for us then it becomes a point of do we want to make a statement for the reputation's sake. And then we calculated how much time we involved. I think they're in Germany. So the arbitration everything would take in Germany. And also when a thing like this go to the court, every single document becomes open. That means there's going to be tracebacks on every little details that they did, every little detail we did during the communication. It will blow up as a full story, again, right? And we calculated is it going to look good on us even if in the end we win? Do we earn like the reputation PR thing or most people just think Bybit you [__] up. Even till today people say Bybit you got hacked, right? So I admitted I think it was and most likelihood I won't get any money out of it. So the only reason I would be doing is reputation award which we also don't think it's going to be a long legal battle and things. So we're like, 'Okay, then we move on, you know?'

In terms of dealing with it or in terms of the follow-up decisions, you mean?

I think the critical when that moment happens, you got to remind yourself what is your role require you to do at the time. Stop thinking about the consequence because or I guess stop thinking or focus or spending your energy on things you cannot control. Only spend at that critical time on the things you can do. Right? Something I cannot control is the money's already gone. That's out of my control. Something I cannot control is people is going to view us and think that we [__] up. Right? Something I can't control is whatever's happened. But what I can do is do something about it so people might start to think at least we're transparent, right? And we regain the trust. So the whole point at that time is for me to focus on how to do that and also making sure all the teams are met well managed. So the teams are freaking out, right? When the incident happens, if you are not if you don't have your mind in a clear place and giving out orders. So first of all, you got to give very clear orders. If you stop and you are questioning, 'Oh, should we do this?' You're asking the team actually, 'Hey guys, should we do this? Should we do that?' I think they're all going to give you random things and you will never get the answer. So from that point on, I just giving marching orders. Finance team you do this. Wallet team you do this. Social media team you do this. PR team get ready. I'm going to go on a live stream. So everything is in order and they feel like, 'Okay, every team is stopping not in chaos.' And you start to see some teams a little bit chaotic. Like customer support, everyone's freaking out, what do we do? I say, 'Okay, we're going to give everyone withdrawal, don't worry, right?' Calm the client down and we're going to do in this order. And then so they can go back and do their job. So I think that's the most important for me, yeah.

Um and then it's gone. Yeah. Right. Because people be like, 'Oh, the Bybit hack or the SwissBorg hack or FTX or people who lost their money in Luna.' And then life moves on. And some people are basically dead. Some people are alive and that's it. And it's all based on a bunch of decisions you made before and then it just continues.

It's only to the external. To the internal, we worked on this thing for the next 12 months after the hack, right? There was a full plan. First of all, we realized we can never rely on a third party on such a big asset. So we need to build a banking-grade cold wallet system that's completely bulletproof, right? Then we consulted all the security firms and the existing solutions. We picked the most secure solution, which is a banking-grade HSM locked in a vault. But typically the problem with HSM is this hardware that even if you like the problem with iPhone, if you put it in a very cold temperature like minus 20 something, you can extract all the information out of it. That's the problem with regular hardware, right? But if you are in a completely cold HSM, even if it goes in a hydro cold solution, it will destroy itself. It's a military-grade banking vault secret key keeping machine. But those machines are designed typically for many other purposes, not only for crypto. So you need a layer on top like application. And we can obviously design this but it would take us too long. So we need a third party. Normally the HSM wallet team, hardware team provides that but we don't use it because we worry if they know it's me and they have both systems. So we need another third party that provides only this layer. And then so we find this time with multiple three, four firms, eventually we find this that can match this. And we put them in a physical location with a vault. Inside the vault is completely no internet and there's multiple cameras. And then there's multiple layers of solutions where you how you design the room. If there's a fire, there's automatic oxygen is gone, let's say. Like all sorts of things. So it took us almost eight months to design, execute and then to make sure that there's multiple layers of team who open the door. There's one team that opens door, one only one key keeper can go in and then he releases to the other guy who sets the key. Crazy. But in the conclusion is you really literally have to be physically breaking into that vault and you have to know all my key personnel and half of them have to be co-working with this guy to be able to do something about it. So I think that's what only one thing we did. On top of that there was multiple audits happened and stuff. So this is ongoing for us for a long, long, long time. Yeah, yeah.

In terms of staffing or?

85 million users globally.

63, I think.

No, no. So this is just register and KYC. 85 million. If you talk about active user, we don't really look at the monthly, we look at the daily. We probably have a half million using the app, logging to the app or the website. Half a million user every day. Yeah, yeah.

I think the next dimension is really to become this one financial platform where truly we can be the place that offers true financial freedom where they get access to all sorts of asset classes they want. Bybit was the first exchange that offered TradFi where it now is already available in Binance and other exchanges but we were the first. So we spent quite an amount of energy to connect users in crypto back into TradFi and connect TradFi players back into crypto. And also offer payment card solutions, basically whatever you want to do with your money, Bybit should be the kind of one-stop shop that helps you with that.

I think in the future the concept of bank, broker, crypto exchange all going to merge. Essentially it's one place where money things does. Can do all the things that money can do. Buying a stock, buying gold, making investment or having a flexible savings card, spendings, payment spendings, transfers, pay bills, buy cars, you know, anything it should be within one app.