The problem is not that the box was opened, it's that there was a security issue with Bybit's risk control. Even a low-level BD can easily access everyone's KYC