Bybit Review 2026: Is It Safe? The US$1.5 Billion Hack, Proof of Reserves, Licences, Fees and Sign-up

Bybit is one of the two exchanges I have used the longest. The other is Binance.

The short version: Bybit was founded in 2018 and ranked third by derivatives open interest on CoinGecko on 7 October 2026. About US$1.5 billion was stolen from it in February 2025, but withdrawals were not suspended at the time, and the ETH shortfall was closed within about 72 hours. Its proof of reserves is published roughly once a month and verified by Hacken; the snapshot of 23 September 2026 showed BTC 104%, ETH 103%, USDT 110%. Regular users pay 0.1% on spot.

This article shares my own experience and research. It is not investment, tax or legal advice. Fees, rates, licences and service regions can change; every figure here is dated, so check Bybit’s official pages before you act. Crypto prices are volatile, and keeping assets on an exchange carries the risk of the exchange itself.

Bybit key factsData checked: 2026-10-08

As of 2026-10-08, Bybit's general-user spot taker fee is 0.1% and its futures taker fee is 0.055%. Its 2026-09-23 proof of reserves showed BTC 104%, ETH 103%, USDT 110%.

Item	Details	Source
Jason Finance rating	61.7 / 100	rating method
Highlights	Hacken-verified monthly proof of reserves 2025 hack: users made whole, withdrawals stayed open EU MiCA authorisation
General-user fees (taker)	Spot 0.1%, futures 0.055%	2026-10-08
Invitation code fee discount	Official sign-up offer (not a fee discount)	2026-10-07
Proof of reserves	2026-09-23 (monthly): BTC 104%, ETH 103%, USDT 110%	2026-10-08
Main licences and registrations	EU MiCA (Austria FMA), UAE SCA licence, India FIU registration	source 1 source 2 source 3
Order book depth (±2%)	BTC/USDT about 8.2M USD, ETH/USDT about 4.1M USD	2026-10-08

What kind of exchange Bybit is

The user figure and the “world’s second-largest exchange” label are Bybit’s own claims. CoinGecko rankings change every day; the table is a snapshot from 7 October 2026, sourced from CoinGecko.

Is Bybit safe?

Proof of reserves: roughly monthly, verified by Hacken

A proof of reserves compares what an exchange holds in its wallets with the total of all user balances. A ratio of 100% or more means that, at the time of the snapshot, the exchange held enough coins to cover every user’s balance.

Bybit’s 40th report (snapshot taken on 23 September 2026):

The report covers the 50 largest coins by asset value. Bybit says all of them are above 100%, and Hacken verified the report independently (40th report press release, verification report PDF). In 2026 a report came out roughly every month, but Bybit does not state a fixed schedule.

You can verify your own account with a Merkle tree on the proof of reserves page to confirm that your balance was included. Keep in mind that a proof of reserves is a snapshot at one point in time, not a full financial audit, and it does not show that the exchange has no other liabilities.

The February 2025 hack: about US$1.5 billion, withdrawals kept running

According to Bybit’s incident timeline, on 21 February 2025 an Ethereum multisig cold wallet was attacked during a routine transfer from cold to warm wallet. The attackers faked the transaction details shown in the multisig interface and changed the wallet’s contract logic. Bybit put the loss at about US$1.46 billion (401,347 ETH plus other ETH derivative tokens); most reports round it to about US$1.5 billion. The US FBI said in a public service announcement on 26 February that a North Korean hacking group was responsible.

What happened next:

• Withdrawals were not suspended: Bybit says it processed 99.994% of more than 350,000 withdrawal requests within about 10 hours. CoinDesk reported outflows of more than US$4 billion after the hack (CoinDesk).
• The shortfall was closed: the CEO said user assets remained backed 1:1. Through bridge loans, deposits from large holders and over-the-counter purchases, Bybit closed the ETH shortfall within about 72 hours (The Block), and it published another verified reserve report on 26 February.

There are two sides to this. Cold wallets can be breached too; but Bybit was able to absorb a loss that size on its own within a few days, and withdrawals never stopped.

The insurance fund only covers futures liquidations

Bybit’s Insurance Fund absorbs losses when a futures position is forcibly liquidated at a price worse than its bankruptcy price (official explanation). It is not deposit insurance for users, and I found no description from Bybit of a protection fund for ordinary user assets.

Account security settings

Security features Bybit offers (official guide):

• Login and verification: Google 2FA, passkeys (log in with the biometrics on your phone or computer) and trusted device management.
• Withdrawals: a fund password (separate from the login password), a withdrawal address allowlist, a withdrawal lock on new addresses, app-only withdrawals, and secure transaction approval (one designated main device approves).
• Anti-scam: an anti-phishing code; once it is set, Bybit’s official emails and text messages include it.

After signing up, I suggest turning on at least 2FA, the fund password and the withdrawal address allowlist.

Bybit licences and service regions

Many articles say Bybit holds a Dubai VARA licence, but the VARA register shows only an In-Principle Approval; its full licence in the UAE is the federal SCA licence.

Restricted regions: under the terms of service (Traditional Chinese version updated 3 October 2026), residents of the United States, mainland China, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Russian-controlled regions of Ukraine, Sudan and Syria cannot use Bybit. Japan is not on the list, but Bybit stopped new registrations from Japan on 31 October 2025 and is gradually withdrawing.

Past regulatory actions:

• Ontario, Canada (June 2022): settled and disgorged about US$2.47 million, and undertook not to accept Ontario residents again (OSC).
• France (from 2022): placed on a blacklist by the Autorité des marchés financiers (AMF), before Bybit received MiCA authorisation.
• Malaysia (December 2023): the Securities Commission ordered it to stop operating locally, and Bybit complied.
• India (January 2025): fined about 92.7 million rupees (about US$1.1 million) for operating without registration, and registered afterwards (FIU-IND order).

How to sign up for Bybit

Create an account with an email address or phone number, enter the invitation code in the invitation code field, then complete identity verification (KYC). Easy Earn Flexible requires at least standard KYC, and after KYC you can check which fee tier applies to you under “My Fee Rates”.

Bybit trading fees: 0.1% spot, 0.02% futures maker

From Bybit’s official fee schedule (7 October 2026):

• The VIP tier is based on asset balance or 30-day trading volume, whichever is higher, and is updated daily at 07:00 UTC. The 30-day volume for spot VIP 1 is US$1 million.
• A maker order waits on the order book for someone else to fill it; a taker order fills against an existing order.
• Special trading areas such as fiat purchases and the Innovation Zone have different fees; for example, the VIP 0 taker fee for buying crypto with fiat is 0.2%.

In money terms: a regular user buying 1,000 USDT of BTC at market pays 0.1% taker, or 1 USDT. Most people’s assets and volume never reach VIP 1, so in practice they pay VIP 0 rates.

Deposits and withdrawals: on-chain deposits and internal transfers are free. Withdrawals pay a fixed network fee that does not depend on the amount and differs by chain; the withdrawal page shows the current fee (official explanation).

Depositing USDT to Bybit on-chain

To send USDT to Bybit from another exchange or your own wallet, choose the coin and network on Bybit’s deposit page, copy the address, and withdraw from the sending side. The sending side and Bybit must use the same network; with the wrong network, the funds may not be recoverable.

Data from Bybit’s official API (7 October 2026); the deposit page shows the current figures.

Bybit Easy Earn: USDT flexible rates and risks

Bybit’s earn product is called Easy Earn, with flexible and fixed terms (official FAQ).

• Rate: on 7 October 2026 USDT Flexible was tiered, with an estimated 7.2% APR up to 200 USDT and 2.2% on the part above 200 USDT. Rates change daily, and Bybit notes they are for reference only and not guaranteed.
• Yield source: Bybit says flexible yield comes from its lending business.
• Redemption: the flexible product has no lock-up period and can be redeemed at any time; yield is calculated hourly and paid daily to the funding account.
• What “principal protected” means: Bybit’s principal protection refers to the number of coins, not their value in fiat.

The 7.2% only applies to the first 200 USDT, so the more you deposit, the closer your overall APR gets to 2.2%. If you are deciding whether to put idle USDT into an exchange earn product, my article Where to park idle USD and USDT compares the extra risk you take with short-term Treasury ETFs, Aave and Bitfinex lending.

Pros and cons: who Bybit suits

For the two exchanges I later started using as well, see the OKX review and the Bitget review. More exchange guides and comparisons are on the crypto topic page.

FAQ

Is Bybit safe?

Bybit publishes a Hacken-verified proof of reserves roughly once a month, and in the snapshot of 23 September 2026 BTC, ETH and USDT were all above 100%. About US$1.5 billion was stolen from it in February 2025, but withdrawals were not suspended and the ETH shortfall was closed within about 72 hours. A proof of reserves is a snapshot at one point in time, not a financial audit, and it does not guarantee the future.

Did Bybit users lose money in the hack?

According to Bybit's incident report, the stolen funds came from one Ethereum multisig cold wallet, with losses of about US$1.46 billion. Bybit says user assets stayed backed 1:1, that 99.994% of more than 350,000 withdrawal requests were processed within about 10 hours, and that the ETH shortfall was closed within about 72 hours.

What are Bybit's trading fees?

Regular users (VIP 0) pay 0.1% maker and 0.1% taker on spot, and 0.02% maker and 0.055% taker on perpetual and delivery contracts (official fee schedule, 7 October 2026). You only move up to VIP 1 with US$100,000 in assets or enough 30-day volume.

Does Bybit hold a Dubai VARA licence?

Not a full licence. When I checked VARA's public register on 8 October 2026, Bybit Fintech FZE only had an In-Principle Approval issued on 21 August 2024, not a full operating licence. Bybit's full licence in the UAE is a virtual asset platform operator licence from the federal Securities and Commodities Authority (SCA), and in the EU Bybit EU GmbH holds MiCA authorisation approved by Austria's FMA.

Where is Bybit not available?

Under Bybit's terms of service, residents of the United States, mainland China, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Sudan, Syria and some other places cannot use it. In Japan, Bybit stopped new registrations on 31 October 2025 and is gradually withdrawing.

Can I redeem Bybit Easy Earn Flexible at any time?

Bybit says the flexible product has no lock-up period and can be redeemed at any time. On 7 October 2026 USDT Flexible used tiered rates: an estimated 7.2% APR up to 200 USDT and 2.2% on the part above that. Rates change daily and are not guaranteed.