Is Bybit Safe? A 2026 Review
Putting money on an exchange that lost $1.5 billion to hackers is a reasonable thing to hesitate over. Bybit was breached in February 2025 in what multiple outlets reported as the largest cryptocurrency theft publicly disclosed at the time. The real question isn't whether it happened — it did — it's whether your funds would actually be safe there today.
Quick verdict: Bybit operates through regulated or registered entities in several jurisdictions, though its regulatory status and availability vary by country, and it is not available to US residents. The platform introduced additional security controls after its February 2025 hack, publishes regular Proof of Reserves, and states that customer balances were not reduced as a result of the incident. Not risk-free. It's worth understanding what happened before deciding.
What "Safe" Actually Means Here
"Safe" isn't one thing. This review assesses several distinct dimensions: whether an attacker can steal funds (security controls), who actually holds your assets (custody), whether the exchange operates under real oversight (regulatory status), whether it holds what it owes customers (Proof of Reserves), whether withdrawals can be restricted (operational risk), and how risky its higher-leverage products are (trading risk). An exchange can score well on some of these and poorly on others, which is exactly Bybit's situation.
Is Bybit Available in the US?
No. Bybit does not accept US residents, alongside restrictions in the UK, Canada, France, and Singapore. If you're in the US, this review is informational, not actionable.
The 2025 Hack: What Actually Happened
On February 21, 2025, attackers compromised a Bybit Ethereum cold wallet and stole approximately 400,000 ETH, valued at around $1.4–1.5 billion at the time. Rather than breaching Bybit's core exchange infrastructure, the attack exploited the third-party Safe{Wallet} platform used in the exchange's multisignature transaction approval process. While this distinction helps explain how the breach occurred, it also highlights a significant weakness in the withdrawal authorization workflow that Bybit relied upon.
The attack has been attributed by the U.S. Federal Bureau of Investigation (FBI) to North Korea's Lazarus Group, a state-sponsored cybercrime organization known for targeting cryptocurrency platforms. According to the FBI, the group was responsible for stealing the digital assets and laundering the proceeds through multiple blockchain transactions.
What the Hack Means for Bybit Users Today
The hack targeted cold-storage signing infrastructure, not routine account access, and customer withdrawals continued functioning throughout. Bybit reported that it covered the shortfall through emergency financing and its own reserves, and stated that customer balances were not reduced as a result of the incident. Independent confirmation of full restitution rests substantially on Bybit's own disclosures and subsequent Proof of Reserves reporting, not on a separate third-party audit of the recovery specifically.
The practical lesson: cold storage reduces certain risks but doesn't eliminate operational or process risk, and Proof of Reserves confirms solvency at a snapshot — it doesn't prevent an incident like this from happening again. Users should still enable 2FA, withdrawal whitelisting, and API restrictions regardless of how an exchange's cold storage is architected.
Is Bybit Regulated?
Jurisdiction | Status | What It Covers |
|---|---|---|
UAE (Dubai) | VARA authorization | Virtual asset exchange activities |
European Union | MiCA-related authorization via Bybit EU GmbH, Austria's FMA | Relevant crypto-asset services in the EU |
Kazakhstan | Registered under AFSA | Regional exchange operations |
India | Registered with the Financial Intelligence Unit | AML/compliance framework, not a trading license |
The exact permitted activities under each authorization should be confirmed against the regulator's own public register before treating this as a complete picture; this table reflects what's consistently reported across sources, not independent verification of each license's full scope. Check Bybit's own licensing and regulatory disclosures directly, since jurisdiction-specific status can change. For a broader framework on evaluating any exchange's regulatory standing, see how to choose a regulated crypto broker →.
Security Checklist
Feature | What It Does |
|---|---|
Two-factor authentication | Protects against password compromise alone |
Withdrawal address whitelisting | Restricts withdrawals to pre-approved addresses |
API permission controls | Limits what connected apps or bots can access |
Cold storage | Keeps the majority of funds offline |
Proof of Reserves | Periodic transparency into asset backing |
Bug bounty program | Encourages responsible vulnerability disclosure |
Bybit's Proof of Reserves
Bybit publishes monthly Proof of Reserves with verification by Hacken, an independent blockchain security firm. The June 2026 snapshot reported reserves covering customer liabilities at or above 100% for the assets included in that report. This is a verification of on-chain assets against liabilities at a specific point in time, not a conventional financial statement audit, and it doesn't guarantee an exchange can't be hacked, become insolvent, or restrict withdrawals in the future.
Fees
Bybit's spot trading fees run around 0.1% maker/taker as a starting tier, reducible with higher volume or native-token payment. (Note: derivatives fee schedules, withdrawal fees, and the full VIP tier structure should be verified against Bybit's current fee schedule before relying on a complete breakdown.)
Supported Products and Assets
Bybit supports spot trading, derivatives, options, P2P, and staking, with leverage available up to roughly 100x on select perpetual futures products — availability and maximum leverage vary by jurisdiction and account eligibility. High leverage substantially increases liquidation and loss risk; this isn't a feature to treat casually regardless of the ratio advertised. See what leverage trading actually involves → before using any leveraged product.
Customer Support
At the time of this review, Bybit's Trustpilot rating was approximately 3.4/5, with common praise for platform functionality and common complaints about account restrictions and support response times. Trustpilot reflects customer sentiment, not a security or safety measure, and shouldn't be read as evidence either way on that front.
Bybit vs Binance vs Coinbase
Criterion | Bybit | Binance | Coinbase |
|---|---|---|---|
US availability | Not available | Binance.US only | Available |
Security incident | $1.5B hack (2025), users made whole | $4.3B DOJ settlement (2023) | No comparable incident |
Regulatory footprint | Multi-jurisdiction (VARA, MiCA-EU) | Multi-jurisdiction, disclosed legal history | Strong US presence, publicly listed |
Proof of Reserves | Monthly, via Hacken | Published via cryptographic verification | FDIC pass-through on USD balances |
Bybit and Binance present genuinely different risk considerations, not directly comparable ones. Bybit's most significant recent issue was a security breach it says it fully covered; Binance's is a disclosed regulatory and legal settlement. Compare based on which risk profile, and which product range, fits what you actually need. Full detail on Binance's situation: Is Binance Safe for US Traders? →.
Who Is Bybit Best For?
May suit: experienced traders, those wanting both spot and derivatives access, users outside restricted jurisdictions, and traders comfortable with advanced interfaces.
May not suit: US residents, beginners unfamiliar with leverage risk, anyone wanting a simple spot-only platform, and users who weigh the 2025 hack as disqualifying regardless of the response.
Common Mistakes to Avoid
Assuming Proof of Reserves means real-time protection. It's a snapshot, not a continuous guarantee — treat it as a positive transparency signal, not a reason to leave large balances on any exchange indefinitely.
Ignoring withdrawal-address whitelisting. This single control would have limited exposure in several historical exchange incidents industry-wide. Enable it, and don't skip reviewing existing approved addresses periodically.
Treating derivatives access as a default setting. If you're not actively using leveraged products, disable that API permission specifically, reducing what an attacker could do even with partial account access. Understand leverage risk → fully before enabling it at all.
Pros and Cons
Pros
Bybit states it fully covered the 2025 hack shortfall with no reduction to customer balances
Broad product range: spot, derivatives, options, P2P, staking
Multi-jurisdiction regulatory presence including MiCA-EU authorization
Monthly independently-verified Proof of Reserves
Cons
Subject to a large, publicly disclosed security breach in 2025
Not available to US, UK, Canadian, French, or Singaporean residents
Regulatory scope varies by jurisdiction and isn't uniformly deep
Customer support sentiment is mixed
Is Bybit Safe? Our Verdict
Bybit today operates through registered or authorized entities across several jurisdictions and has strengthened its security controls following a serious 2025 incident. That incident is a legitimate reason for caution; it exposed a real weakness in third-party infrastructure Bybit depended on. Bybit's own account of its response — full restitution with no reduction to customer balances — is a meaningfully better outcome than several other major exchange incidents have historically produced, though that account rests significantly on Bybit's own disclosures. Not risk-free. Not disqualifying either. Verify current Proof of Reserves yourself, and never treat any single exchange as the only place your funds should sit.
Where This Fits on TradeMesa
Choosing a regulated broker is a separate decision from choosing a signal provider. TradeMesa doesn't execute trades — our signals and courses work alongside whichever regulated broker you've already vetted.
Frequently Asked Questions
Is Bybit safe in 2026?
Bybit has strong core security today — monthly Proof of Reserves, withdrawal controls, cold storage — and no user lost funds in its 2025 hack.
Was Bybit hacked?
Yes. In February 2025, attackers stole approximately $1.5 billion in ETH, the largest crypto hack on record. Bybit covered the entire loss itself; no user funds were lost.
Is Bybit available in the US?
No. Bybit does not accept US residents, along with restrictions in the UK, Canada, France, and Singapore.
Is Bybit regulated?
Yes, across multiple jurisdictions including VARA in Dubai and an MiCA-authorized entity in the EU.
What is Bybit's Proof of Reserves?
A monthly independent verification, conducted by Hacken, confirming Bybit holds sufficient assets to cover customer liabilities at the snapshot date.
Does Bybit have FDIC insurance?
No. FDIC insurance doesn't apply to crypto exchanges or crypto assets.
Did anyone lose money in the Bybit hack?
No. Bybit absorbed the loss itself and made every affected user whole.
Who was responsible for the Bybit hack?
Security researchers and multiple outlets, along with the FBI, have attributed the attack to North Korea's Lazarus Group, using social engineering and malicious code targeting third-party multisig wallet infrastructure.
Is Bybit better than Binance?
Depends what you're weighing. Binance carries disclosed federal legal history from a 2023 DOJ settlement; Bybit carries a 2025 hack it fully covered. Compare based on which risk profile fits your needs. Learn what leverage trading actually involves →
Does Bybit offer leverage trading?
Yes, up to roughly 100x on select perpetual futures products, in addition to spot trading, options, and staking.
This review reflects publicly available information as of the time of publication. It is not financial advice. Full Risk Disclaimer →
The TradeMesa Editorial Team consists of experienced writers, researchers, and trading specialists who create and review educational content covering crypto and forex markets, trading strategies, risk management, and platform guides. Our content is researched, fact-checked, and regularly reviewed to maintain accuracy and relevance.