Binance founder CZ has opened up about one of the more uncomfortable moments in crypto incident response: what to do with customer withdrawals in the minutes after an exchange gets hacked. Speaking in an interview with When Shift Happens, host KevinWSHPod, CZ said that after Bybit was hacked on September 25, 2026, he publicly suggested the exchange consider pausing withdrawals as a precaution. His reasoning was simple — stop abnormal outflows before they get worse. The broader conversation around the Binance CZ withdrawal pause recommendation has since become a useful case study in how exchanges weigh security against user access during a live crisis.

Key takeaways

• Bybit was hacked on September 25, 2026, according to comments CZ made in an interview with When Shift Happens.

• CZ publicly recommended pausing withdrawals to prevent further abnormal fund outflows.

• He acknowledged that halting withdrawals could disrupt trading and inconvenience users, but argued security risks should come first.

• Bybit ultimately did not pause withdrawals, and CZ said no further issues occurred afterward.

• CZ concluded there is no absolute right or wrong approach in these situations — the real issue is risk assessment.

Summary of Bybit Hack and CZ’s Recommendation

CZ’s account centers on a single, clear-cut moment: Bybit was hacked on September 25, 2026, and within that window he went public with a specific piece of advice — pause withdrawals. He framed it as a more cautious security measure designed to prevent further abnormal outflows of funds while the exchange figured out what had happened and contained the damage.

Details of the Bybit hack incident

The source material does not go into the technical mechanics of the breach itself. What’s documented is the timeline marker — September 25, 2026 — and the fact that it was serious enough to prompt a prominent industry figure to weigh in publicly on how Bybit should respond.

CZ’s public advice on pausing withdrawals

CZ made his recommendation in an interview with When Shift Happens, hosted by KevinWSHPod. That public forum is notable in itself: rather than offering private counsel, CZ aired his view on withdrawal suspension as a general principle for handling exchange breaches, turning a specific incident into a broader conversation about crisis protocol.

Trade-offs Between Security and User Convenience

The core tension CZ described is one every exchange faces mid-breach: lock the doors and protect what’s left, or keep operations running and risk further losses. There’s no clean answer, and his comments make that trade-off explicit rather than glossing over it.

Potential impacts of pausing withdrawals on trading continuity

CZ was direct about the downside. Suspending withdrawal services, he said, could disrupt trading continuity and leave users unable to move their funds when they want to. For an exchange, that’s not a small cost — it can mean frustrated customers, reputational friction, and operational headaches that outlast the security incident itself.

CZ’s prioritization of security risks

Even so, CZ’s position was that security risks should take priority over that short-term inconvenience. In his view, the potential for continued fund loss outweighs the disruption caused by a temporary freeze — a stance that puts containment ahead of customer experience when the two collide.

Bybit’s Response and Outcome

Bybit chose a different path than the one CZ recommended, and the reported result was that nothing further went wrong. That outcome is the part of the story that complicates any easy takeaway about the right way to handle a breach.

Bybit’s decision not to pause withdrawals

Despite CZ’s public suggestion, Bybit ultimately did not pause withdrawals after the hack. The exchange kept that service running rather than freezing it as a precaution.

Resulting operational status post-hack

According to CZ, no further issues occurred following Bybit’s decision to keep withdrawals open. He pointed to that outcome as evidence that caution and action can both lead to acceptable results, depending on how the underlying risk is actually assessed in the moment.

Philosophy on Incident Management and Risk Assessment

CZ’s closing point reframes the whole episode: this isn’t really about which single rule to follow during a hack, it’s about judgment calls made under pressure with incomplete information.

CZ’s view on no absolute right or wrong approach

CZ said there is no absolute right or wrong in such situations. Bybit’s choice not to pause withdrawals worked out this time, but that doesn’t make it a universal rule any more than his own recommendation to pause would have been.

Importance of risk assessments in security incidents

What matters, in his telling, is proper risk assessment in the moment — reading the scale of the breach, the likely behavior of attackers, and the operational cost of each option before deciding. That’s the practical lesson sitting underneath the back-and-forth over the Binance CZ withdrawal pause suggestion: exchanges need a sound process for weighing security against continuity, not a fixed playbook that applies to every hack the same way.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.