Is Bybit safe? Its European company, Bybit EU GmbH, has held a MiCA authorisation from Austria's FMA since 28 May 2025, and Bybit holds local licences in the UAE, Kazakhstan and Georgia. The global site, bybit.com, is run under a contract with Bybit Technology Limited, which none of those licences cover. On 21 February 2025 attackers stole more than USD 1.4 billion in ETH from a Bybit cold wallet; Bybit closed the gap in about 72 hours and user balances were not cut. The latest proof of reserves we verified (snapshot 23 September 2026) showed BTC at 104% and USDT at 110%. Regular users pay 0.055% taker and 0.02% maker on futures and 0.1% on spot, and signing up with code FEEOTTER and linking your UID gets a 40% rebate (checked 24 October 2026).
This review draws on Bybit's help centre, the ESMA register, an FBI notice and our own published articles on licences, reserves and hacks. It covers licences, proof of reserves, security record, legal entity, products, fees, KYC and restricted regions, then explains how to claim the rebate. For fee details see Bybit fee rebate.
Quick verdict
- Licences: EU MiCA (Bybit EU GmbH, bybit.eu), UAE SCA, Kazakhstan AFSA, National Bank of Georgia, India FIU-IND registration; in Indonesia a local subsidiary, Bybit Indonesia, holds the OJK licence. Japan's FSA has warned Bybit twice for operating without registration.
- Proof of reserves: Merkle tree, roughly monthly; the official page also lists monthly PoR audits by Hacken.
- Security record: the February 2025 ETH cold-wallet theft, about USD 1.5 billion, is the largest of the 12 exchange incidents we track. Bybit covered the loss.
- Fees: VIP 0 futures 0.055% / 0.02%, spot 0.1% / 0.1%; after the 40% rebate a futures taker pays 0.033%.
- Where you can't use it: the US, mainland China, Hong Kong, Singapore, Canada and others. You need at least Standard KYC to deposit or trade.
Bybit at a glance
| Item | Detail |
|---|---|
| Contracting entity (global site) | Bybit Technology Limited; terms effective 16 October 2026, Singapore law, disputes go to SIAC arbitration |
| European site | Bybit EU GmbH (bybit.eu), Vienna, authorised by Austria's FMA |
| Main products | Spot, USDT/USDC perpetuals and dated futures, inverse contracts, options, copy trading, trading bots, Earn, P2P, TradFi (gold, forex and more) |
| VIP 0 fees | Spot 0.1% taker, 0.1% maker; futures 0.055% taker, 0.02% maker |
| Proof of reserves | Period 40 (snapshot 2026-09-23): BTC 104%, ETH 103%, USDT 110%, USDC 223% |
| KYC | Standard, Advanced and Pro; unverified accounts cannot deposit or trade |
| Fee Otter rebate | 40%, all paid by Fee Otter (Bybit has no automatic rebate layer); you link your UID on Fee Otter |
Sources: Bybit trading fee structure (updated 2026-09-02) and the ESMA MiCA register, checked 2026-10-24; the contracting entity is from the Bybit platform terms as read on 2026-10-23 (see crypto exchange legal entities); reserve ratios are covered below.
Licences and regulators: which company, where
Bybit's licences belong to different companies. An account opened on bybit.com is a contract with Bybit Technology Limited, and that company itself appears on none of the EU or Asian licences in this table.
| Region | Entity / status | Source and date |
|---|---|---|
| EU (MiCA) | Bybit EU GmbH, Austria's FMA, authorised 2025-05-28; passported to 29 countries, Spain included, Malta not | ESMA CASP register, checked 2026-10-24 |
| UAE | Securities and Commodities Authority (SCA) virtual asset platform operator licence | Bybit announcement |
| Kazakhstan | Full AFSA licence (Bybit Limited, AIFC) | Bybit announcement |
| Georgia | National Bank of Georgia VASP registration | Bybit announcement |
| India | FIU-IND reporting entity registration | Bybit announcement |
| Indonesia | Local subsidiary PT Enkripsi Teknologi Handal (Bybit Indonesia) is on the OJK list; the global entity, Bybit Fintech Limited, is on OJK Satgas PASTI's June 2026 list of entities submitted for blocking | Bybit press release, 2026-07-16; OJK release (2026-06-22) |
| Japan | FSA warnings to Bybit Fintech Limited for unregistered business on 2023-03-31 and 2024-11-28 | Japan FSA |
| Hong Kong | Affiliate Spark Fintech Ltd applied to the SFC on 2025-06-06; still under review | SFC applicant list, read 2026-10-18 |
The UAE, Kazakhstan, Georgia and India entries are Bybit's own announcements; our register checks are in crypto exchange licences by country, and the scope and passport list of the EU authorisation are in MiCA-licensed crypto exchanges. A licence protects users who contract with that company in that region. A global-site user gets no EU protection from Bybit EU's MiCA authorisation.
Proof of reserves: latest period and how to read it
Bybit has published proof of reserves since December 2022. A Merkle tree lets you check that your balance is included, and Bybit proves wallet ownership with on-chain transfers to itself. The latest period we verified on the official page on 28 September 2026 was period 40 (snapshot 23 September 2026, 03:00 UTC):
| Coin | Reserve ratio |
|---|---|
| BTC | 104% |
| ETH | 103% |
| USDT | 110% |
| USDC | 223% |
Source: Bybit proof of reserves page. The page did not load when we checked again on 2026-10-24, so a newer period may be out; the official page is the reference. The report covers 50 coins, none below 100%, and the official "Independent Audit Report" page lists monthly PoR audits by Hacken. Past periods, the scope of the Hacken audit and self-verification steps are in Bybit proof of reserves; the cross-exchange table is in proof of reserves compared.
A reserve ratio only shows whether the wallets covered user balances at the moment of the snapshot, and it leaves out the exchange's own borrowing and other liabilities.The February 2025 theft happened between two snapshots.
Security record: the February 2025 cold-wallet theft
On 21 February 2025 an Ethereum multisig cold wallet was attacked during a routine transfer. Bybit's announcement put the loss at more than 400,000 ETH and stETH, worth over USD 1.4 billion. On 26 February the FBI attributed the attack to North Korea's TraderTraitor (FBI notice). Bybit said withdrawals stayed open. It filled the ETH gap with loans and support from large holders within about 72 hours (CoinDesk), and a later Hacken reserve report confirmed 1:1 backing of user assets.
The attackers manipulated the signing interface of a cold wallet; most exchange thefts we track hit hot wallets instead. For how this compares with 11 other exchange incidents and who repaid whom, see exchange hacks and who got repaid; for exchanges that collapsed, see crypto collapse history.
On the account side, Bybit offers Google 2FA, a fund password, passkeys, an anti-phishing code and a withdrawal address whitelist, and a newly added withdrawal address cannot receive funds for 24 hours.
Products
- Derivatives: USDT and USDC perpetuals and dated futures, inverse (coin-margined) contracts and options. Rules are in the Bybit futures guide.
- Copy trading and bots: see Bybit copy trading and Bybit trading bots.
- Earn: flexible and fixed products; once your UID is linked, Earn interest is shared with you too, see Bybit Earn rebate. Exchange savings products are not bank deposits.
- P2P and TradFi: see Bybit P2P and Bybit gold and forex fees.
Fees and fees after the rebate
| Level | Spot taker / maker | Futures taker / maker | Futures taker after 40% rebate |
|---|---|---|---|
| VIP 0 | 0.1% / 0.1% | 0.055% / 0.02% | 0.033% |
| VIP 1 | 0.08% / 0.0675% | 0.04% / 0.018% | 0.024% |
| VIP 2 | 0.0775% / 0.065% | 0.0375% / 0.016% | 0.0225% |
| VIP 3 | 0.075% / 0.0625% | 0.035% / 0.014% | 0.021% |
Source: Bybit trading fee structure (updated 2026-09-02), checked 2026-10-24. Bybit notes that actual rates may vary by region; the "My Fee Rate" page after KYC is the reference. VIP levels depend on 30-day volume or assets and refresh daily at 07:00 UTC, see Bybit VIP levels; paying fees with MNT is covered in Bybit fee discount.
Our example: a VIP 0 user trades 500,000 USDT of futures notional a month with market orders. Fees are 500,000 × 0.055% = 275 USDT. With code FEEOTTER and a linked UID, the 40% rebate is 110 USDT, so the user pays 165 USDT net, or 3.3 USDT per 10,000 USDT traded. Bybit's 0.055% futures taker fee is a little above the 0.05% at Binance and OKX; after the 40% rebate it comes to 0.033%.
KYC and account rules
Every Bybit product needs at least Standard KYC (ID plus face check); unverified accounts cannot deposit or trade. Review usually takes about 15 minutes and can take up to 48 hours. A driver's licence, a passport and an ID card can each verify one Bybit account, and sub-accounts cannot do KYC. Withdrawal limits per level and common rejection reasons are in the Bybit KYC guide (source: Bybit individual KYC FAQ).
Restricted regions
Bybit's service-restricted countries page (updated 2026-10-16, checked 2026-10-24) lists the US, mainland China, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Ukraine's Crimea (including Sevastopol) and the non-government-controlled areas of Donetsk, Luhansk, Kherson and Zaporizhzhia, Sudan and Syria. Bybit Virtual Asset Platform Operator LLC, the SCA-licensed UAE company, also excludes Dubai. Sanctioned parties and individuals in Seychelles are not served either. Bybit states that if you misrepresent where you live, it can close the account at once and liquidate open positions. A country-by-country table for the big four is in Binance, OKX, Bybit, BingX restricted countries.
The rebate has its own regional rule: Section 11 of the Bybit affiliate terms excludes residents of Hong Kong, mainland China, the EU, the UK, the US, Singapore, Canada, Australia and other places, and users there cannot receive the rebate.
Bybit pros and cons
| Pros | Cons |
|---|---|
| Local licences in the EU, UAE, Kazakhstan and elsewhere | The global-site entity is outside those licences; two warnings from Japan's FSA |
| Lost more than USD 1.4 billion in 2025 without cutting user balances | The largest of the 12 exchange thefts we track happened at Bybit |
| Monthly proof of reserves with a Hacken PoR audit | PoR does not show all liabilities or what happens between snapshots |
| Full product range: futures, options, copy trading, bots, Earn, TradFi | 0.055% futures taker fee, slightly above exchanges charging 0.05% |
| Earn interest is shared too | Long restricted list, plus extra regional exclusions for the rebate |
Who Bybit suits
Bybit suits people who trade USDT perpetuals, want copy trading, bots and Earn in one account, and live somewhere it serves. Residents of the European Economic Area should use bybit.eu, which is the site the MiCA authorisation covers.
It does not suit residents of the US, mainland China, Hong Kong, Singapore, Canada or other restricted places, or anyone who needs a locally licensed platform (residents of Japan, for example). Keep only the money you are trading on an exchange and move long-term holdings to your own wallet.
How to claim the Bybit rebate
The Bybit rebate is 40%, all paid by Fee Otter. Bybit has no automatic exchange rebate, so there is one extra linking step:
Sign up with the code
enter referral code FEEOTTER on the sign-up page; steps are in how to register on Bybit.Complete KYC
at least Standard, or you cannot trade.Link your UID
on the Fee Otter rebate dashboard, pick Bybit and paste your UID. We only need the UID, never an API key or password.Track and withdraw
rebates usually reach the dashboard on T+1 and are paid as on-chain USDT on BEP20, minimum 1 USDT per request, with the 0.015 USDT network fee paid by the user.
Already have a Bybit account? If your main account is less than 14 days old and has no referrer, you can add our affiliate ID 163627 in the form (the ID, not FEEOTTER). Steps are in add a Bybit referral code within 14 days; after 14 days, see the Bybit rebind guide (KYC transfer).
Telegram · @feeotter