Bybit Review 2026: Fees, Security & the $1.5B Hack, Honestly Assessed

What is Bybit?

Bybit launched in 2018 as a derivatives-first exchange and has grown into one of the largest crypto trading venues in the world by volume. It now serves tens of millions of registered users, per company claims, across spot trading, perpetual futures, options, earn products, copy trading, trading bots, a Web3 wallet, a crypto card, and P2P markets. Its headquarters are in Dubai, and it operates through several separately licensed regional entities.

The platform's identity is still derivatives: deep order books, a wide range of perpetual contracts, and tooling aimed at frequent traders. Spot trading and passive products were added later and are solid, but Bybit is not designed as a simple buy-and-hold app for first-time buyers. Beginners can use it, but the product menu rewards users who already understand order types, margin, and funding rates.

The February 2025 hack, honestly assessed

On 21 February 2025, Bybit suffered the largest crypto theft on record. During a routine transfer of ETH from a cold wallet to a warm wallet, attackers drained about 401,347 ETH plus staked ETH derivatives, roughly $1.46 billion at the time. The theft was not a breach of Bybit's trading engine. Attackers had compromised credentials belonging to a developer at Safe, the multisig wallet tool Bybit used, and used them to spoof the signing interface shown to Bybit's wallet signers. The signers approved what looked like a routine transfer, but the underlying transaction had been swapped to replace the wallet's implementation contract with a malicious one and redirect the funds.

Five days later, the FBI publicly attributed the attack to North Korean actors it tracks as TraderTraitor, linked to the Lazarus Group. Independent reviews commissioned afterward found no evidence that Bybit's core infrastructure had been compromised, according to the exchange, a claim worth noting as company-reported rather than independently verified. On-chain investigator ZachXBT traced the stolen funds across thousands of addresses and received a bounty for the work. Most of the ETH was converted into Bitcoin and dispersed, and only a small fraction has been frozen or recovered since.

How Bybit responded

The response is the part of this story that matters most for trust, and it is unusually well documented. CEO Ben Zhou disclosed the breach publicly about 90 minutes after it happened, confirmed that one cold wallet was affected, and said withdrawals would continue normally. He then stated that Bybit remained solvent even if the stolen funds were never recovered and that client assets were backed 1:1, and he took live questions from users the same evening.

Over the next 12 hours, Bybit processed a record wave of more than 350,000 withdrawal requests as users rushed for the exit, and the exchange let every one of them through. Behind the scenes it secured bridge loans and bought ETH over the counter, with on-chain data showing roughly 100,000 ETH of inflows from the wider exchange ecosystem. By 24 February, three days after the attack, Bybit said it had fully closed the ETH gap and published a new audited proof-of-reserves report. For context, our exchange security incidents timeline covers how other platforms handled smaller breaches far worse.

What changed afterward, and what did not

Bybit says it ordered third-party penetration testing and hardened its wallet-signing processes ahead of its EU licensing application, and it went on to secure a MiCA license in Austria and a full UAE license within months of the attack. Regulators do not hand those out to insolvent or opaque firms, so the licensing run is meaningful external evidence that the company's finances and controls withstood scrutiny. A public bounty program for freezing and recovering the stolen funds remains active.

What did not change: the stolen funds are overwhelmingly still gone, which is the normal outcome for state-linked crypto thefts. And the attack vector, a compromised third-party signing interface deceiving human approvers, is a reminder that multisig and cold storage are only as strong as the screens people sign on. No user lost funds, but the incident should permanently retire the idea that any exchange balance is risk-free.

Pros and cons

Regulation and availability

Bybit's regulatory footprint expanded significantly after the hack. In May 2025, Austria's Financial Market Authority granted Bybit EU GmbH a MiCA license, passporting services across 29 EEA states, and EEA users were migrated to the dedicated bybit.eu platform in July 2026. Note that derivatives on bybit.eu remain limited pending further permissions: Bybit applied for a MiFID II license in September 2025, and per public statements from the CEO, approval was expected in late 2026. In October 2025, the UAE's Securities and Commodities Authority granted Bybit a full Virtual Asset Platform Operator license covering the UAE mainland. The company also holds registrations or licenses in Kazakhstan, Georgia, and India, and serves UK users with spot trading only through the FCA-authorized firm Archax.

The other side of that map is a long restricted list. Bybit does not serve residents of the United States, mainland China, Hong Kong, Singapore, or Canada, among other jurisdictions. Identity verification is mandatory for meaningful use, with higher verification levels unlocking higher limits and selected services. Availability also varies by product: an account can exist while a specific derivative, earn product, or fiat route stays unavailable. Do not attempt to bypass restrictions with a VPN. It conflicts with platform terms and can leave funds stranded during a compliance review.

Fees and costs

Bybit's published entry-tier schedule is straightforward: 0.10% maker and taker on spot, 0.02% maker and 0.055% taker on perpetual futures, and 0.02% maker and 0.03% taker on options. VIP tiers reduce these rates based on 30-day trading volume or asset balance. On headline futures pricing, Bybit sits near the competitive end of the market, roughly in line with Binance and OKX at the entry tier.

As with every exchange, the commission is only one cost layer. Perpetual positions pay funding rates that change with market conditions, spreads and slippage apply in fast markets, conversion and withdrawal fees vary by asset and network, and card-funded deposits carry processor charges. Treat the figures above as a starting point and check the live fee schedule for your exact product, tier, and legal entity before trading.

Platform and products

The core trading experience covers spot, margin, perpetual futures, and options, with leverage advertised up to 100x on the most liquid contracts. Around that core sits a full product menu: Bybit Earn (flexible savings, fixed staking, dual investment, crypto loans), copy trading, trading bots including grid and martingale strategies, a Launchpad and Launchpool for new token listings, P2P markets, an OTC desk, a Web3 wallet, and a crypto card for spending balances. Bybit has also added traditional-market instruments such as TradFi perpetuals and MT5-based CFDs.

The interface is polished by exchange standards, with capable charting and a functional mobile app for iOS and Android, but the sheer number of products, order types, and settings can overwhelm newcomers. Beginners should treat the derivatives terminal, bots, and especially martingale strategies as advanced tools, not starting points. Spot buying, small sizes, and limit orders are the sane way to learn the platform.

Security

Beyond the hack itself, Bybit's published security stack includes two-factor authentication, withdrawal address whitelisting, anti-phishing codes, cold storage for the bulk of user assets, and encrypted connections. It publishes monthly proof-of-reserves reports with Merkle-tree verification, assessed by the security firm Hacken, and discloses wallet ownership so users can check reserves themselves. A bug bounty program covers the platform and the stolen-funds recovery effort.

The honest framing: these are standard controls for a large exchange, and they did not prevent the 2025 theft, because the attack targeted the human signing step through a trusted third-party tool. Proof of reserves shows assets at a point in time; it does not prove liabilities are fully covered or that operational security is flawless. Use the security features, verify the PoR reports if you like, and still keep only trading funds on the exchange.

Who Bybit may suit, and who should skip it

Bybit may suit active traders who want deep futures liquidity, competitive derivatives fees, and many products under one roof, and who are comfortable with KYC and with keeping disciplined, limited balances on an exchange. It can also work for spot traders in supported regions who want an alternative to the biggest venues.

Skip Bybit if you live in a restricted jurisdiction, if you want to trade anonymously, if you are an absolute beginner looking for the simplest possible first purchase, or if you want your long-term holdings under the strongest available regulatory protections. In that last case, a regulated spot-first exchange plus self-custody is the more conservative combination.

Alternatives to consider

No single exchange fits everyone, and Bybit's restricted list alone rules it out for many readers. US and EU-focused users often compare Kraken and Coinbase for their regulatory footprint, while OKX competes directly on derivatives with its own MiCA licensing. Our best crypto exchanges of 2026 guide compares the leading options by fees, availability, and trust factors so you can match a venue to your jurisdiction and trading style.

Verdict

Bybit is a capable, competitive exchange for active traders, and its handling of the February 2025 hack is genuinely the best crisis response the industry has seen: fast disclosure, open withdrawals, and users made whole within days. That record deserves weight in any trust assessment, alongside the MiCA and UAE licenses earned afterward.

But the hack also proved that custody risk at Bybit is real, not theoretical, and no licensing or proof-of-reserves report eliminates it. Use Bybit for what it is good at, active trading with competitive fees, keep balances limited to what you trade, and hold the rest in self-custody. For beginners, start with spot, skip leverage until you understand liquidations, and verify every fee and restriction on the live site before depositing.

Frequently asked questions