Bybit clients withdrew almost $4 billion within two days of the attack; the company recovered just 3% of the total of the stolen crypto assets