Bybit
Lost roughly $1.4–1.5bn in February 2025, the largest exchange theft on record, and paid every user in full without ever stopping withdrawals.
- Founded
- 2018
- Registered
- United Arab Emirates
- Site
- www.bybit.com
The short answer
In February 2025 it lost roughly $1.4–1.5bn to a compromised third-party signing tool — the largest exchange theft ever recorded — and withdrawals never stopped. The gap was closed and no user lost money. That is the only test of solvency that has ever meant anything, and Bybit is the one venue in our rating that has passed it under maximum stress. A $10,000 bitcoin buy cost 0.10% when we measured it. Fiat rails are the weak point, scoring 2 out of 10.
Key facts
| February 2025 theft | Roughly $1.4–1.5bn, the largest exchange theft on record, through a compromised third-party signing tool rather than Bybit’s own systemsas of 14 Jul 2026 |
|---|---|
| Outcome for users | Withdrawals never stopped, the gap was closed, and no user lost moneyas of 14 Jul 2026 |
| Proof of reserves | Monthly, liability-inclusive via a Merkle tree, attested by a named third-party firm — most recently June 2026, above 100% coverage of every in-scope asset. The verification tool is open source.as of 14 Jul 2026 |
| The ~$986m "insurance fund" | A derivatives liquidation backstop, not theft cover. We do not count it as a protection fund.as of 14 Jul 2026 |
| Effective cost, $10,000 BTC buy (measured by us) | 0.10% — joint-cheapest in our rating; 0.1043% at $100,000as of 14 Jul 2026 |
| Order-book depth within 0.1% (measured by us) | 62.2 BTC — a third of Kraken’sas of 14 Jul 2026 |
| API response latency (measured by us) | 254 msas of 14 Jul 2026 |
| Fiat rails | The weakest of any venue we rate, scored 2 out of 10as of 14 Jul 2026 |
Bybit is the only exchange that has proved it can pay
Every exchange claims it holds your money. One has demonstrated it while losing the largest sum in the industry’s history. In February 2025, roughly $1.4–1.5bn left Bybit through a compromised third-party signing tool. Withdrawals never stopped, the gap was closed, and no user lost money.
Nothing else in this category comes close as evidence. A proof of reserves shows assets on a date. An insurance fund is a promise about an event that has not happened. Bybit had the event, at a scale that has bankrupted every comparable firm, and processed withdrawals throughout. That is the test, and passing it is not something marketing can manufacture.
Two qualifications keep it honest. The theft came through tooling Bybit chose to trust rather than its own systems, which is a supply-chain failure and still a failure — selecting your dependencies is part of running a custodian, and we dock it for that. And a solvent response to one loss is not a guarantee about the next; it demonstrates the balance sheet at that moment, not a permanent property.
On reserves it is also among the best here: monthly, liability-inclusive via a Merkle tree, attested by a named third-party firm, most recently in June 2026 at over 100% coverage of every in-scope asset, with an open-source verification tool. Monthly and attested beats the quarterly-or-nothing that most of the category offers.
What Bybit actually costs
A $10,000 bitcoin buy cost 0.10% on 14 July 2026, joint-cheapest in our rating alongside Binance and Bitget, rising only to 0.1043% at $100,000. For anyone trading regularly that is at the cheap end of what exists.
The book is thinner than the headline suggests. We measured 62.2 BTC within 0.1% of best ask — about a third of Kraken’s 189.8 and well under half Binance’s 142.0 — which is why the cost rises at $100,000 where Binance’s does not. At retail size it does not matter; at size it does, and the gap widens as the order grows.
API response latency measured 254 ms, mid-table and better than Binance’s 460 ms.
The real cost is fiat. Bybit scores 2 out of 10 on fiat rails, the lowest of any venue we rate, which means getting money in and out in your own currency is awkward in a way the trading fee does not capture. A cheap trade at a venue you cannot easily fund is not cheap.
Incident record
| Date | Type | Amount | Were users made whole? |
|---|---|---|---|
| 21 Feb 2025 | Hack or exploit | $1,500,000,000 | Yes, in full. Withdrawals were never suspended and the shortfall was closed; no user lost money. The strongest solvency evidence produced by any exchange in our rating, because it was produced under the worst conditions on record.$1,500,000,000 returnedsource |
In our ratings
Compared with
Our coverage of Bybit
- How to spot a fake proof of reserves27 Sept 2026
- Bitget loses $351.6m — and the fund it says covers it is one we could not verify25 Sept 2026
- Is Kraken safe? The evidence, and what it lacks25 Sept 2026
- What happens to your coins if an exchange goes bankrupt23 Sept 2026
- Is Coinbase safe? What its own filings say19 Sept 2026
- How to move crypto off an exchange, step by step17 Sept 2026
- Token approvals: the permission that drains wallets15 Sept 2026
- What "not your keys, not your coins" leaves out9 Sept 2026
- The seed phrase mistakes that cost people everything7 Sept 2026
- Hardware wallet or software wallet: how to decide5 Sept 2026
Questions people ask
Did Bybit users lose money in the 2025 hack?
No. Roughly $1.4–1.5bn was taken in February 2025, the largest exchange theft on record, and withdrawals were never suspended. The shortfall was closed and no user lost money — the only demonstration of solvency under maximum stress in our rating.
How was Bybit hacked?
Through a compromised third-party signing tool rather than its own systems. That is a supply-chain failure, and choosing your dependencies is part of running a custodian, so we dock it — but it is a different failure from an exchange’s own infrastructure being breached.
Is Bybit’s insurance fund theft cover?
No, and this is widely misread. The roughly $986m fund is a derivatives liquidation backstop that covers bankrupt leveraged positions, not stolen customer assets. We do not count it as a protection fund. What Bybit has instead is a demonstrated ability to pay.
Does Bybit publish proof of reserves?
Yes, and among the best here: monthly, liability-inclusive via a Merkle tree, attested by a named third-party firm, most recently June 2026 at above 100% coverage of every in-scope asset, with an open-source verification tool.
Is Bybit cheap?
Yes on trading — 0.10% on a $10,000 bitcoin buy, joint-cheapest in our rating. Less so in practice if you need fiat: it scores 2 out of 10 on fiat rails, the weakest of any venue we measure, so funding and withdrawing in your own currency is the friction.
What changed
- 27 Sept 2026 — Profile published.