Bybit is a major crypto derivatives and spot exchange known for perpetual futures, copy trading and trading bots. It ranked fifth in the CoinMarketCap spot exchange snapshot captured on August 14, 2026. The ranking understates how central derivatives are to its identity—and says nothing about the event every 2026 review must confront: the approximately $1.5 billion theft from Bybit in February 2025.
Bybit continued operating and said it restored backing for in-scope customer assets within 72 hours, but the theft was not a minor incident. This review finds a liquid and feature-rich venue for experienced traders in permitted regions, with a security history that justifies strict limits on custodial balances.
Company and access
Bybit launched in 2018 and built its audience around crypto perpetual contracts before expanding spot, options, earn products, cards, bots and institutional services. Ben Zhou is co-founder and chief executive.
The company serving an account depends on region. Bybit is unavailable or restricted in several countries, including the United States. Bybit EU uses a locally structured operation for eligible European customers. Other users contract through different Bybit entities and terms.
Do not use a VPN or false address to access a prohibited product. A residence mismatch can surface during withdrawal review and weaken any complaint.
Markets and platform design
Bybit offers spot markets, USDT- and USDC-settled perpetuals, inverse contracts, dated futures and options. It also provides spot and futures grid bots, DCA tools, copy trading, P2P and yield products where available.
The interface is fast and information-dense. Active traders get charting, conditional orders, APIs and unified account functions. Beginners can misread a leveraged contract as a simple coin purchase, especially when moving collateral across account types is easy.
Copy trading does not transfer responsibility to the lead trader. Followers can enter at different prices, experience slippage and be liquidated even when a leaders displayed history looks profitable.
Bybit fees
Regular-user spot pricing has commonly started around 0.10% maker and 0.10% taker, with tier reductions based on volume and account criteria. Derivatives use a different maker/taker schedule and add periodic funding between long and short holders.
On a 10,000 USDT spot trade at 0.10%, the visible fee is 10 USDT. A perpetual position may have a lower execution fee but incur funding repeatedly while open. Borrowing and options have separate costs.
Bybit changes regional and VIP rates, so use the fee page inside the actual account. Withdrawal fees vary by asset and chain. A low trading fee can be outweighed by a high network withdrawal charge or wide spread on a small pair.
The February 2025 theft
On February 21, 2025, attackers compromised a signing workflow during a transfer from a Bybit Ethereum cold wallet and diverted assets. The FBI attributed the approximately $1.5 billion theft to North Koreas TraderTraitor actors. The agency said stolen assets were converted and dispersed across thousands of addresses on multiple blockchains.
The attack was widely described as the largest crypto theft at the time. It did not originate from customers revealing passwords; it exploited institutional transaction signing and deception around what signers believed they were authorizing. That makes it directly relevant to custody assessment.
Bybit kept withdrawals operating and used reserves, borrowing and industry liquidity to close the balance-sheet gap. Its February 24 statement said a Hacken review covering 40 asset types verified at least 1:1 backing for in-scope customer assets after reserves were restored.
The recovery avoided customer losses at the platform level, but it does not undo the control failure. It shows both resilience and the scale of concentrated custody risk.
Proof of reserves after the hack
Bybit publishes Merkle-tree proof-of-reserves reports that allow users to check inclusion of account liabilities. After the theft, rapid third-party verification was important because customers needed evidence that withdrawals remained covered.
Proof of reserves answers a limited question: whether specified assets and customer liabilities meet the reported ratio at a snapshot. It does not prove that every future signing process is secure, reveal all corporate liabilities or prevent borrowed assets from supporting a temporary snapshot unless methodology addresses them.
Read the auditor, asset list, wallet-ownership method and snapshot date. A “1:1” label without those details is incomplete.
Regulatory status
Bybits marketing has highlighted regulatory expansion, but the exact stage matters. The Dubai VARA record for Bybit Fintech FZE currently shows an in-principle approval issued August 21, 2024 for exchange services, reference IPA/24/08/001. VARA explains that an IPA lets an applicant complete requirements and is not the same as a full VASP licence permitting operations.
Bybit also established a European operation under Austrias MiCA framework for eligible EEA customers. That regional service has its own entity and product catalogue. Users should not apply a European permission to a global account or assume every derivative is covered.
Regulatory pages can change. Match the current legal entity in the account terms with the regulators live entry immediately before depositing.
Account security
Bybit offers authenticator two-factor authentication, passkeys in supported environments, anti-phishing codes, address whitelisting and device controls. Activate them before adding funds. Store API secrets outside source code and disable withdrawals for trading bots.
After the institutional hack, users should pay special attention to withdrawal confirmations. Verify asset, network, destination and amount on a separate device when possible. A fake browser extension can alter what is shown.
Bybit support should never request a seed phrase or ask a user to move assets to a “safe” private wallet supplied by an agent. Impersonators use the 2025 hack as a believable pretext.
Deposits and withdrawals
Crypto funding supports many chains. Send a test above the minimum and ensure the destination supports the token contract and network. P2P and fiat options depend on region and third-party providers.
Bybits decision to keep withdrawals available during the 2025 crisis was a strong operational response. It should not be interpreted as a guarantee that every future withdrawal will be instant. Security resets, compliance reviews, Travel Rule data, network maintenance and P2P disputes can delay transfers.
Keep transaction hashes and case numbers. A genuine restriction can require KYC or source-of-funds evidence, but not an additional crypto deposit to unlock existing money.
Complaints and liquidation disputes
Common user complaints involve liquidation, copy-trading results, bonus conditions, P2P payment fraud and account restrictions. A liquidation claim should include contract, leverage, entry, collateral, mark price, maintenance margin and timestamp. The last-traded price alone may not be the liquidation reference.
P2P users must confirm money in their own bank account rather than trust a payment screenshot. Payments from third parties can create fraud and compliance problems after crypto is released.
Who should use Bybit？
Bybit fits experienced traders who need liquid perpetuals, sophisticated orders, copy trading or automation and who reside in a supported jurisdiction. Spot users can also find competitive pricing and a broad asset list.
It is a poor fit for U.S. residents, leverage beginners, or users uncomfortable with the implications of the 2025 custody breach. Long-term holdings do not need to remain on a derivatives exchange.
Verdict
Bybit demonstrated exceptional operational resilience after losing about $1.5 billion, restoring reported reserve coverage without imposing a customer haircut. It also suffered a signing-control failure of historic scale. Both facts belong in the conclusion.
Use Bybit only through the correct entity, verify the live regulatory status, keep leverage modest or absent, and withdraw idle holdings. Its CMC rank confirms substantial market activity; the February 2025 event confirms why no centralized exchange should be treated as an invulnerable vault.
