Bybit Review: What It Offers, and How to Judge If It's Safe

This review covers what Bybit offers, what it costs, and — most importantly for a YMYL topic — how to judge whether it's safe for you, rather than asserting a one-size verdict.

Bybit at a glance

• Founded: 2018, by Ben Zhou (still CEO)
• Entity / headquarters: Bybit Fintech Ltd (British Virgin Islands); Dubai, UAE (moved from Singapore in 2022)
• Assets: several hundred spot coins (1,000+ trading pairs)
• Products: Spot, derivatives, copy trading, grid bots, P2P, Earn
• Custody: custodial (Bybit holds funds on-platform)

Fees

Spot is 0.1% / 0.1%; USDT perpetuals are 0.02% maker / 0.055% taker. Full breakdown — including funding — in Bybit fees explained.

Features

Bybit is derivatives-first but full-range. Beyond spot and USDT/USDC perpetuals (up to 100x), it offers copy trading for hands-off mirroring of experienced traders, grid and other trading bots, P2P for local-currency on/off-ramps, and Earn products for yield. It suits active derivatives traders and copy-traders; long-term holders are usually better served by self-custody than by leaving funds on any exchange.

Is Bybit safe? A framework, not a slogan

"Safe" isn't a yes/no badge — judge any exchange on factors you can verify:

• Availability & compliance. Bybit holds an EU MiCA licence (Bybit EU GmbH, authorised by Austria's FMA in May 2025, passported across the EEA) plus registrations in the UAE, Kazakhstan, Georgia and India. But it is banned in the US, restricted in the UK (since Dec 2025 it offers spot and P2P only via an Archax partnership — no derivatives), and not available in Canada, Singapore, mainland China or Hong Kong. Check your country's current status before signing up.
• Security track record. In February 2025, Bybit suffered the largest crypto hack ever — ~$1.4 billion (≈401,000 ETH), when an offline multisig cold wallet was drained via a compromised Safe{Wallet} signing interface (attributed to North Korea's Lazarus Group). The decisive part for users: withdrawals were never halted, Bybit replenished its reserves within ~72 hours, and it absorbed the loss — no customer funds were lost. Most of the stolen funds were not recovered.
• Proof of reserves. Bybit publishes regular Merkle-tree proof-of-reserves, independently verified by Hacken, reported at or above 100% on major assets — with increased frequency since the hack. Its derivatives insurance fund (~$400M) covers liquidation shortfalls only, not a deposit guarantee.
• Withdrawal reliability. A real test came during the hack, when Bybit processed roughly $4 billion in withdrawals in ~12 hours without freezing. Still, test with a small withdrawal of your own before you commit larger sums.

bybit.com

12

1. 1The 1:1-reserve claim — reserves published openly.
2. 2Verify your own reserves (Merkle tree), or view the reserve ratio / audit report.

Whatever the platform, reduce your own risk: enable 2FA, set a withdrawal allowlist, and keep long-term holdings in self-custody.

Who Bybit is for

A reasonable fit if you're an active derivatives or copy trader in a market where it operates, you want a deep derivatives venue with low fees, and you accept custodial risk with your own safeguards.

Not a fit if you're in the US (banned), want leverage in the UK (spot/P2P only there), or you're a long-term holder who'd be safer in self-custody than on any exchange.

New to the products Bybit offers? Start with Crypto futures, explained and Copy trading, explained.