AI Doesn’t Forget Your Hack. It Forgets That You Fixed It.

On 21 February 2025, attackers took $1.5 billion from Bybit, the largest crypto theft of its time. Bybit covered the loss from its own reserves and loans and was back to full backing within about 72 hours. No customer lost money.

Twenty months later, ask ChatGPT “Is Bybit safe?” and the first line is “I would not call it ‘safe'”. The hack comes next. We asked the same question 12 times across ChatGPT, Perplexity, Claude and Gemini. All 12 answers named the hack, and 11 put it first. Eight said that reserves were restored or that users lost nothing, almost always after the hack and usually in a single clause.

ICODA ran the same test on five crypto brands with hacks between one month and six years old, 296 answers in total. Across all five, AI keeps the hack and gets the facts right, and it loses the part crisis teams work hardest on, the fix. That puts AI reputation management on every crypto brand’s crisis plan, as the step after the post-mortem.

Key Findings

• Time does not erase a hack. Kelp DAO’s April 2026 exploit comes up in 92% of answers to neutral questions about the protocol. Ledger’s October 2026 implant crisis, one month old, comes up in 31%.
• AI gets the facts right. Of 169 answers that mention a hack, 2 got a core fact wrong (date, amount, cause or attacker).
• The recovery goes missing. Kelp DAO’s users got all their money back. One answer in four says so, and all 12 answers to “Is Kelp DAO safe?” advise caution.
• A six-year-old leak outranks a one-month-old crisis. Ledger’s 2020 customer-data leak appears in 52% of Ledger answers, the 2026 implant in 31%.
• Without search, AI hands out clean records. 29 of 45 Gemini answers to neutral questions ran without web search. None of them mentioned the hack.

Twenty Months Later, Bybit Is Still “the Hack”

Bybit is the test case for good crisis handling. The theft was the largest on record. The response was fast and public: reserves restored, withdrawals honoured, a bounty programme for the stolen funds. By any crisis-PR standard, the story ended in March 2025.

AI answers tell it differently. In 11 of 12 answers to “Is Bybit safe?”, the hack is the lead point, either the first risk listed or the reason for the verdict. Claude: “The 2025 custody theft remains the biggest weakness in its security record.” Perplexity: “The biggest reason for caution is the major February 2025 incident.”

The recovery is there in 8 of 12 answers, but it rarely leads. In ChatGPT’s answer it is a subordinate clause (“…and that it restored backing for customer assets”), followed by a “but”. Gemini puts it most kindly: “no user funds were lost or haircut”. Claude puts it most accurately for a worried reader: “Restoring the reserves isn’t the same as recovering every stolen asset.”

Every fact in these answers is accurate, and the order still works against Bybit: the reader learns first that it lost $1.5 billion, and only later, if at all, that its users lost nothing.

The Memory Curve That Isn’t a Curve

If AI forgot crises the way the news cycle does, the oldest hack would be the quietest. Bybit’s hack, the oldest of the five we tested, ties for second place.

Crisis Memory Score: share of answers to “Is X safe?”, “Should I use X?” and “X vs [rival]” that bring up the hack without being asked. 36 answers per brand.

The order runs close to the reverse of recency. Kelp DAO at seven months scores 92. Bybit at 20 months scores 72. Ledger’s newest crisis scores 31, below its six-year-old data leak.

Ledger scores low because of how AI files the implant. In the answers we studied for our anatomy of the Ledger crisis, AI engines framed the implant as tampering by a reseller rather than a Ledger hack. In this test, all 12 answers to “Is Ledger safe?” still called Ledger safe, with caveats. That framing protects Ledger now, and it leaves an older incident in the lead (more on that below).

AI rarely gets the facts wrong. Across 169 answers that mention a study hack, 2 got the date, amount, cause or attacker wrong, both from Gemini presenting Bitget’s suspected North Korean attribution as settled. What varies is which true facts make it into the answer.

Kelp DAO Paid Everyone Back. AI Mostly Doesn’t Say So

Three of the five brands made their users whole. Their recovery stories reach AI answers at very different rates.

Bitget’s recovery is told in 33 of 34 answers that mention its September hack. Bybit’s in 30 of 38. Kelp DAO’s in 11 of 45.

Within days of the April exploit, a coalition led by Aave, with commitments from Consensys and Joseph Lubin, raised the funds to re-back rsETH. Arbitrum froze 30,766 ETH of the attacker’s money. Withdrawals reopened on 14 May, and the last tranche landed on 25 May. Kelp’s developer has since sued LayerZero in British Columbia over the exploit.

AI engines describe the exploit in detail and rarely get to the end of the story.

All 12 answers to “Is Kelp DAO safe?” advise caution. In 31 of 36 neutral answers, the hack is given as the reason. Many stop at the Arbitrum freeze or the rsETH depeg. Only 3 of the 12 safety answers say holders got their money back. When one does, the phrasing is telling: “Users were made whole through a bailout by other protocols, not because the system was designed to absorb the loss” (Claude).

The likeliest difference from Bitget and Bybit is in how the recovery was told. Both exchanges paid from their own funds and said so early, in plain terms: the Protection Fund covers all balances; reserves are back to 1:1. Kelp’s recovery unfolded over five weeks across governance votes, coalition updates and freeze announcements. Each step was public, but none came as a single sentence an AI could repeat.

Coldcard is the opposite case. Coinkite has paid no compensation, and AI says so: all four answers to “Did Coldcard users get their money back?” are correct, and all four add that white hats rescued 52 BTC for victims through the Crypto Recovery Trust. AI repeats a clear “no” accurately and drops a five-week, many-party “yes”.

Ledger: The 2020 Leak Outranks the 2026 Implant

Ask about Ledger and AI reaches past last month’s crisis to one from 2020.

The 2020 customer-data leak appears in 25 of 48 Ledger answers. The 2023 Connect Kit attack appears in 19. The October 2026 implant, which drained about $100 million from buyers of tampered devices sold through resellers, appears in 15. Asked “Has Ledger ever been hacked?”, all four engines lead with 2020. Only Perplexity mentions the implant, as the third of three points.

Asked whether Ledger users got their money back, ChatGPT assumes “the hack” means the 2023 attack, the one where Ledger did pledge refunds. A buyer who lost funds to an implanted device a month ago would read this as a yes.

The answers are also standing still. We repeated the ten questions from our 16 October audit word for word. One week after the crisis, 22 of 40 answers mentioned it. One month after, the count was again 22. Asked how much was stolen in “the Ledger hack”, ChatGPT still answers with the 2023 figure of about $600,000. Only 2 of 40 answers carried any news from after 16 October.

Only one answer moved. On 16 October, ChatGPT called MediaMarkt “generally a safe place to buy a Ledger”. On 9 November: “I would not buy a Ledger from MediaMarkt right now.”

What the Model Remembers When It Doesn’t Search

Every engine we tested can search the web, but it decides for itself whether to. When it doesn’t, it answers from what the model learned in training, and that memory is older than the news.

Gemini skipped search in 29 of its 45 answers to neutral questions. None of those 29 mentioned the hack. Some went further and described a spotless record:

• “Bybit has never suffered a major centralized wallet hack or direct loss of user funds.”
• Bitget “has maintained a clean record without major publicized exchange-draining hacks.”
• “No Ledger device has ever had its private keys remotely stolen or extracted in the wild via a firmware or hardware exploit.”

The training memory also holds on to superlatives. On 29 October, Binance lost about $6.3 billion, which makes Bybit’s theft the second largest on record. Eleven days later, 10 answers from Claude and Gemini still called Bybit’s hack the largest on record, as a current fact (“the largest crypto heist in history”, Claude). ChatGPT and Perplexity wrote “at the time”.

Search corrects some of this, and it also pulls in fresh news that reorders comparisons. Eleven days after Binance’s hack, ChatGPT and Claude rate Bybit the safer exchange in answers to “Bybit vs Binance”: “Bybit currently looks safer than Binance on recent platform-security evidence” (ChatGPT).

AI Reputation Management After a Hack: Four Steps

1. Ask the questions your users ask, every month. “Is [brand] safe?”, “[Brand] vs [rival]: which is safer?” and “Did [brand] users get their money back?”, in ChatGPT, Perplexity, Claude and Gemini. The answers differ by question: Claude left Bitget’s hack out of all three “Is Bitget safe?” answers, then named it in every “Bitget vs OKX” answer. Our free AI Visibility Checker is a starting point.

2. Put the fix in the same sentence as the hack. “In February 2025 we lost $1.5 billion; no customer lost funds.” That is the shape AI repeats for Bitget and Bybit. A recovery spread across forum threads and partner posts gets cut at the first step.

3. Give the recovery its own dated page and third-party coverage. AI answers lean on what search finds and what media repeat. A post-mortem that ends with “users were made whole on [date]”, picked up by the outlets AI engines cite, gives the engines a sentence to quote. That is the joint work of crypto PR, search reputation management and AI search optimisation.

4. Don’t wait for an old incident to fade. Ledger’s 2020 leak still leads after six years. Model memory updates slowly, so the counterweight has to be fresh, specific material that search will find when someone asks.

How We Measured

On 9 November 2026 we asked ChatGPT (gpt-5.6-terra), Perplexity (sonar-pro), Claude (claude-sonnet-5.5) and Gemini (gemini-3.8-flash) 34 questions through their APIs, with web search enabled but not forced and a US location. Each of five brands (Bybit, Bitget, Coldcard, Kelp DAO, Ledger) got six questions: three that don’t mention a hack (“Is X safe?”, “Should I keep my crypto on / buy X?”, “X vs [rival]: which is safer?”) and three that do (“Has X ever been hacked?”, “What happened in the X hack?”, “Did X users get their money back?”). Four more covered the Ledger data breach and the safest exchange, hardware wallet and restaking protocol. The three neutral questions ran three times; the rest once. We also repeated the ten questions of our 16 October Ledger audit. Total: 296 answers.

Each answer was coded by hand against fact sheets built from company statements, blockchain analytics firms and major crypto media: whether it mentions the hack, whether the date, amount, cause and attacker are right, whether it mentions the recovery and whether that is right. A second coder re-coded 40 answers blind and matched the first on every hack and recovery code. The Crisis Memory Score is the share of neutral answers that bring up the hack.

API answers are close to, but not the same as, what the consumer apps show, and AI answers change between runs; the ranges across our three runs are shown on the memory curve. ICODA has no commercial relationship with any of the five brands.