Bybit

Bybit is a centralized crypto exchange that began in 2018 with a single bitcoin perpetual contract and grew into a full venue for spot trading, perpetuals, futures, options, copy trading, trading bots, yield products, peer-to-peer trading and a payment card. Its own About page claims more than 89 million users and over $16 billion of average daily trading volume, and it offers 24-hour support.

Ben Zhou is Bybit's co-founder and chief executive and has been its public face, including through the 2025 hack. The company calls Dubai its headquarters, where it set up in 2023, but it does not publish a street address for the global business. The global platform is operated by Bybit Fintech Limited, the entity named in India's 2025 penalty order; Bybit does not state on its main pages where that company is incorporated.

Bybit is privately held and does not disclose its owners. It has no exchange token of its own; fee discounts are paid in MNT, the token of the Mantle network that Bybit's site promotes, and the discount does not apply to API, bot or copy-trading orders.

Most Bybit customers use a Unified Trading Account, introduced in 2022, which Bybit's proof-of-reserves page describes as covering spot, futures, options and margin balances, alongside a funding account that holds crypto deposits and the balance used for the card. Perpetual contracts are the product Bybit is best known for; fee tables also list TradFi perpetuals on stocks and commodities, pre-listing contracts and an Innovation Zone for newer tokens, which carry higher fees.

Which company you deal with depends on where you live. In the European Economic Area customers are served by Bybit EU GmbH through bybit.eu, a separate platform. In the UAE, Bybit's terms refer to Bybit Virtual Asset Platform Operator LLC. In the UK, Bybit relaunched in December 2025 through an arrangement in which Archax, an FCA-authorised firm, approves its financial promotions; Bybit itself is not authorised by the FCA, according to reporting at the time.

The Bybit Card is a debit card funded from the Bybit funding account. Bybit advertises 2% to 10% cashback on crypto spending (fiat spending does not earn it), no annual fee, Apple Pay and Google Pay, and says the card has more than 3 million users. The card page states it is not available to customers in the EEA and only in certain countries. How the Bybit Card compares with other crypto cards is covered on its rating card.

Bybit publishes its fees by product. A regular user pays 0.10% as a maker and as a taker on spot crypto pairs. Fiat pairs cost more for small traders: 0.15% maker and 0.20% taker below $100,000 of 30-day spot volume, with the taker fee falling to 0.12% above $550,000. On standard perpetuals and futures, a regular user pays 0.02% maker and 0.055% taker; Innovation Zone contracts cost 0.04% and 0.11%.

VIP tiers 1 to 5 lower these rates based on 30-day volume or asset balance, and a Supreme VIP tier is by invitation. Bybit says fee groups are reviewed regularly and changes are announced at least a week ahead. Paying fees in MNT gives a further discount on spot and USDT or USDC contracts. Crypto withdrawal fees are set per coin and network and shown before you confirm. Bybit's peer-to-peer marketplace, where users buy and sell crypto with each other for local currency, is advertised in its site footer as charging no fees; the price set by the counterparty is where the cost sits.

On 14 July 2026 this site measured an all-in cost of 0.10% for a $10,000 bitcoin market buy on Bybit, rising to 0.1043% at $100,000, with 62.2 BTC of resting orders within 0.1% of the best ask and an API response time of 254 ms. How Bybit compares with other exchanges is covered on its exchange rating card.

Bybit's restricted-countries notice, updated on 16 October 2026, says it does not offer services in the United States, mainland China, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Sudan, Syria, Crimea and the non-government-controlled parts of the Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine. Bybit says it may close accounts and liquidate positions if a user misstates where they live. Which exchanges Americans can use covers the US alternatives.

In the EEA, Bybit EU GmbH, based in Vienna, holds a MiCA authorisation from Austria's Financial Market Authority dated 28 May 2025 and passported to 29 EEA states. A sister company, Bybit Payments GmbH, is an electronic money institution authorised by the same regulator, according to Bybit. Bybit also lists Dubai's Virtual Assets Regulatory Authority, the National Bank of Georgia and Kazakhstan's Astana Financial Services Authority as its regulators, and says it registered with India's Financial Intelligence Unit in 2025.

Japan is being wound down. Bybit stopped new registrations from Japan on 31 October 2025 and set a deadline in January 2026 for existing users to prove non-Japanese residence, according to Cointelegraph. Identity verification is required for all accounts.

On 21 February 2025 attackers drained about $1.5 billion of ether from one of Bybit's Ethereum cold wallets, the largest theft from an exchange on record. The FBI attributed it to North Korea's TraderTraitor group. The wallet used Safe, a multi-signature smart-contract wallet; Safe later said the attackers had first compromised one of its developers' machines and injected malicious code into its web interface, so that Bybit's signers approved a transaction that looked routine but handed control of the wallet to the attacker.

Bybit did not halt withdrawals. Ben Zhou said on 24 February that the exchange had closed its ETH gap through bridge loans, large deposits and purchases, and Hacken, which reviews Bybit's reserves, reported reserves above liabilities. The stolen ether was laundered quickly and most of it was not recovered; Bybit funded the replacement from its own balance sheet and borrowing. The episode showed that Bybit could absorb a loss of that size; it does not show the same would be true of a larger one.

Bybit's proof of reserves is published monthly. Report #41, for a snapshot at 06:00 UTC on 27 October 2026, covers about 54 assets with ratios of 100% or more for each, including BTC at 102%, ETH at 101%, USDT at 112% and USDC at 405%; the three previous reports put total covered assets between $16.2 billion and $19.6 billion. Customers can check their own balance through a Merkle tree, and the verification code is published on GitHub. Hacken's review reports are listed monthly; the most recent one listed on 29 October was for 23 September 2026. How to spot a weak proof of reserves explains what such reports can and cannot show.

Bybit's pages describe no insurance policy covering customer crypto against theft.

Bybit's regulatory record on file is mostly about operating in countries before registering there. On 31 January 2025 India's Financial Intelligence Unit fined Bybit Fintech Limited Rs 9.27 crore for serving Indian clients without registering under the Prevention of Money Laundering Act, after Indian authorities had blocked its websites; Bybit then registered and reopened in India.

Bybit has also left markets when rules changed: it pulled out of Canada in 2023 and suspended UK services in September 2023 before new financial promotion rules took effect, returning to the UK in December 2025 through Archax. Its Japanese wind-down followed regulatory pressure there.

A balance on Bybit's global platform is a claim on Bybit Fintech Limited, a company whose place of incorporation Bybit does not state on its main pages and which is not licensed in most of the countries its customers live in. Customers of bybit.eu deal with an Austrian MiCA-authorised firm instead, with the safeguards that regime requires.

The 2025 hack showed two things at once: that a cold wallet protected by several signers could still be emptied through a compromised supplier, and that Bybit had the reserves and credit to cover the loss. Neither guarantees the next outcome. Leveraged derivatives, Bybit's core product, can wipe out a position within minutes in volatile markets, and the liquidation rules are set by the exchange.

Access rules change, and Bybit can close accounts of users found in excluded countries. Keep on the exchange only what you are trading and move the rest to a wallet you control.

Accounts are opened on bybit.com or in the Bybit app; EEA residents are directed to bybit.eu. Identity verification is required, and limits depend on the verification level reached.

To withdraw, move funds into the funding account, pick the coin and network, and confirm; the fee is shown first. Close or reduce derivatives positions and redeem Earn products before withdrawing the collateral behind them. Send a small test amount to any new address.

Bybit says its customer support runs 24/7, through its help center and a web form for cases and complaints. Its site footer links to an Authenticity Check page for verifying whether a contact or channel really belongs to Bybit. Use it before replying to any message about withdrawals, frozen accounts or prizes.

Bybit's official X account is @Bybit_Official and its English Telegram community is t.me/BybitEnglish. Sellers of "verified Bybit accounts" are not connected to Bybit; an account verified in someone else's name is controlled, in the end, by whoever holds that identity.

Dated milestones from Bybit, regulators and press reports:

• 2018: Bybit launches with a BTC/USD inverse perpetual contract.
• 2022: Unified Trading Account introduced; proof of reserves published.
• 2023: Dubai headquarters set up; exits Canada and suspends UK services; Bybit Card launched with Mastercard.
• 31 January 2025: India's FIU fines Bybit Rs 9.27 crore; Bybit later registers there.
• 21 February 2025: About $1.5 billion in ETH stolen; shortfall closed by 24 February.
• 28 May 2025: Bybit EU GmbH authorised under MiCA in Austria.
• 31 October 2025: New registrations from Japan stopped.
• December 2025: UK service relaunched through Archax.
• 27 October 2026: Proof-of-reserves report #41.