The US$1.5 billion hack of crypto platform Bybit is by far the biggest in history, but Canadians have mostly been spared from the fallout.

Bybit exited Canada in 2023 after clashing with regulators amid a crackdown on unregistered crypto-trading platforms. The platform’s departure is proof the country’s oversight regime has been successful, crypto industry advocates say.

Dubai-based Bybit has blamed North Korea’s Lazarus Group for the Feb. 21 exploit that resulted in the loss of almost US$1.5 billion worth of customer funds held in the crypto asset ether. The platform was one of the 20 most popular in Canada until the company barred those living in the country from using it in 2023, citing “recent regulatory development” amid a crackdown by Canadian securities regulators.

“This is a perfect example of why we do need regulations,” said Morva Rohani, executive director of the Canadian Web3 Council, an industry association for the crypto sector. “Their inability to negotiate something with [regulators] resulted in Canadians being blocked from the platform, which is what should happen.”

In 2021, the Ontario Securities Commission (OSC) responded to an explosion in unregistered crypto-trading platforms by giving their operators two options: Register and submit to their oversight, or leave the country. Crypto platforms, which had been operating in a regulatory grey area, have a long history of failures, hacks and fraud. The OSC had experience with how badly things could go wrong through its involvement in the fallout from the 2019 collapse of Quadriga, a Canadian crypto platform whose 76,000 users lost a combined $169 million.

A few months after its ultimatum, the OSC announced enforcement actions against Bybit and three other international platforms it alleged were continuing to operate in Canada without starting the registration process. In June of 2022, Bybit and the OSC announced a settlement that saw Bybit agree to pay more than US$2.4 million. Bybit also promised to follow the OSC’s rules while it pursued registration.

In May 2023, Bybit pulled out of the registration process and exited Canada instead, telling its Canadian users it would liquidate their positions if they didn’t withdraw their holdings by Sept. 30. Bybit joined a handful of other international crypto platforms—including Binance—in leaving the country rather than working with regulators in 2023.

Bybit did not respond to a request for comment. OSC spokesperson Julia Mackenzie said she was unable to respond by deadline, but pointed to resources on the regulator’s website about the importance of using a registered platform.

Today, with few exceptions, crypto platforms that accept Canadian customers are registered with securities regulators. Matthew Burgoyne, chair of the digital assets and blockchain group at Osler, Hoskin & Harcourt in Calgary, said that grants users a degree of protection in the event of a hack, because registered platforms must insure user funds and put cybersecurity controls in place.

“It wouldn’t have prevented the hack,” he said. “But it would have ensured that there would be insurance proceeds available.”

Burgoyne said there’s little any regulator can do to prevent the type of hack that took place at Bybit. Hackers gained access through phishing attacks targeted at people with the authority to access the Bybit wallets that held the funds, according to blockchain research firm Chainalysis.

“There’s nothing that you can codify and enforce by way of a regulation or best practice that will absolutely prevent that,” Burgoyne said.

Bybit CEO Ben Zhou has assured customers that the company is solvent and it can cover any client losses. But Rohani said users have no choice but to hope they can take his word for it, in the absence of requirements for audits and other measures that come with oversight and registration.

“Investors are left to rely on a company to come out and provide that assurance after the fact,” she said. “That’s not how it would work if Bybit was regulated in Canada.”