Venues / Bybit

Is Bybit legit?

The checklist

Custody: who holds your money

Balances on the exchange are held by Bybit. Bybit also publishes a proof-of-reserves audit page. Bybit's terms have a separate section on custody and on third-party and self-custody.

Incidents

• 2025-02-21: Roughly $1.4-1.5B stolen from Ethereum cold wallet. Bybit said about 400,000 ETH was stolen, worth roughly $1.4B at the time. The FBI attributed it to North Korea's TraderTraitor actors, with the attack tied to compromised infrastructure at the Safe{Wallet} wallet provider. Bybit said it restored its reserves within 72 hours using about 447,000 ETH from emergency funding by firms including Galaxy Digital, FalconX and Wintermute. It continued to allow withdrawals. source
• 2025-01-31: India FIU penalty. India's Financial Intelligence Unit fined Bybit Fintech Limited about 9.27 crore rupees for operating as an unregistered virtual digital asset service provider. Bybit had suspended trading for Indian users from 2025-01-12. source
• 2024-10-30: Dutch central bank fine. De Nederlandsche Bank fined Bybit Fintech Limited EUR 2.25M for providing crypto services in the Netherlands without the required registration until September 2023. source
• 2023-05: Exit from Canada. Bybit settled with the Ontario Securities Commission in June 2022 (over US$2.4M), then withdrew from Canadian registration in May 2023 and told Canadian users to withdraw holdings by 2023-09-30. source

Real downsides

• Not available in the US, Canada or Singapore, and the UK service is spot and P2P only without FCA authorisation.
• Lost about $1.4B in ETH to a North Korea-attributed hack in February 2025.
• Custodial exchange with mandatory identity verification.
• Faced fines or enforcement from regulators in India, the Netherlands and Ontario.

Can you use it where you live?

Bybit's own restricted-countries page lists the United States, Chinese Mainland, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Crimea and parts of Donetsk, Luhansk, Kherson and Zaporizhzhia, Sudan and Syria as excluded, and for the Dubai-licensed entity also Dubai. The UK is not on that list. Bybit relaunched in the UK on 2025-12-19 with spot and P2P only, under an Archax-approved financial promotion; Bybit's press release says it is not authorised, regulated or registered by the FCA, and UK customers have no FSCS or Financial Ombudsman cover. EEA customers are served by Bybit EU GmbH, authorised under MiCA by Austria's FMA (May 2025). The list can change at Bybit's discretion; check Bybit's page for the current version. (source)

We report what the venue's own terms say. Don't use a VPN to get around restrictions; venues can freeze accounts that do.

How to use Bybit without getting scammed

• Only open www.bybit.com — fake lookalike sites and "support" DMs are the most common way people lose funds on any trading venue.
• Never share a seed phrase or private key. No real support agent will ask for one.
• A referral code only changes your fee and who gets a share of it. It never needs your keys.
• Treat every new memecoin as able to go to zero. A legit venue does not make the coins on it safe.

Comparing options? See the full Bybit sheet or Coinbase Advanced, Robinhood, Gemini.