Bybit

Is Bybit safe?

Bybit has been tested in a way no other exchange has. On 21 February 2025 North Korean hackers stole about $1.5 billion of ether from it, the largest crypto theft ever recorded. Bybit stayed open, honoured withdrawals and covered the loss itself. No customer lost money.

That is both the reassuring and the worrying part. Bybit had the capital to absorb the theft, but the theft happened at all, and from a cold walletCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary. We score it 60/100: a mid-table offshore exchange with good reserve reporting and a weak custody record.

How the $1.5 billion was stolen

Bybit kept most of its ether in a multi-signatureMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary cold walletCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary run through Safe{Wallet}, a widely used smart-contract wallet. To move funds, several Bybit staff had to approve each transaction.

The attackers had compromised Safe{Wallet}'s web interface. When Bybit's signers approved what looked like a routine transfer to a warm wallet, the screen showed them the correct details, but the transaction they actually signed changed the wallet's code and handed control to the attackers. According to Bybit, 401,347 ETH and about 113,000 staked-ETH tokens (stETH, cmETH and mETH), worth $1.46 billion, were moved to 39 addresses. Preliminary forensic reports by Sygnia and Verichains, which Bybit published on 26 February, traced the attack to malicious JavaScript served from Safe{Wallet}'s cloud storage and found no flaw in Bybit's own infrastructure.

On 26 February the FBI attributed the theft to North Korea, under the name "TraderTraitor"; Bybit and blockchain analysts link it to the Lazarus Group. Bybit said about $42.9 million had been frozen within two days, and it offered 10% of any recovered funds as a bounty, up to about $140 million. Most of the rest was laundered through decentralised exchanges and bridges.

Why customers were not hurt

Bybit kept withdrawals open and said it had processed more than 350,000 withdrawal requests, about $4 billion, within roughly 12 hours. By 24 February it said it had closed the ether gap through bridge loans from firms including Galaxy Digital, FalconX and Wintermute, large deposits and over-the-counterOver-the-counterA medicine you can buy without a prescription, in a pharmacy or shop, with directions on the pack for safe use without a doctor.More in the glossary purchases. The same day Hacken checked an updated proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary showing all major assets above 100%.

Under our rubric, a hack with full reimbursement sits between 60 and 79. We put Bybit at the bottom of that band because the size of the loss shows how much depended on one interface and one approval process.

What the hack means for other exchanges

The Bybit theft changed how the industry thinks about cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary. Multi-signatureMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary wallets protect against one stolen key, but not against several honest signers approving a transaction they cannot see properly. Since 2025 exchanges have been adding independent transaction checks on separate devices. For customers, the lesson is that "cold storage" on an exchange's website is a description of a process, not a guarantee.

Proof of reserves

Bybit publishes a proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary every month and has worked with Hacken since June 2024. Each report sets customer liabilities against on-chain assets, and a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary lets users check their own balance was included. On 22 April 2026 the ratios were 109% for bitcoin, 102% for ether, 107% for USDT and 159% for USDC.

Hacken is a blockchain security firm, not an accounting firm, and Bybit does not publish audited financial statements. So the reports show customer coins are there, but say nothing about the company's other debts.

Where Bybit is licensed

Market	Status
EU	Bybit EU GmbH: MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence, Austria FMA (28 May 2025)
EU payments	Bybit Payments GmbH: e-moneyE-moneyMoney held as a stored balance with a payment firm rather than as a bank deposit. It is safeguarded, not covered by deposit insurance.More in the glossary licence, Austria FMA (4 August 2026)
UAE	Headquartered in Dubai, but not on VARA's public register of full licences (October 2026)
UK	Relaunched 19 December 2025 with spot trading and P2P; adverts approved by Archax, an FCA-authorised firm. Bybit itself is not FCA-registered
US	Not available

The global exchange, where most customers trade, operates from Dubai under an offshore company and offers high-leverage derivatives not available in the EU.

The UK arrangement is easy to misread. Bybit left the UK in 2023 when the FCA's crypto promotion rules took effect and came back in December 2025 with about 100 spot pairs. Archax's approval covers what Bybit may say in its adverts, not how it holds your money. Bybit says it is not authorised, regulated or registered by the FCA, and the Financial Services Compensation Scheme and the Financial Ombudsman Service do not cover its crypto services.

How to protect yourself on Bybit

1. Use the regulated entity for your region if one exists (bybit.eu in Europe).
2. Set up a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or Google Authenticator, an anti-phishing code and the withdrawal address whitelist.
3. Avoid high-leverage futures unless you understand liquidation. They cause far more customer losses than hacks do.
4. Keep only trading balances on the exchange. The 2025 theft shows even cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary at a large exchange can fail.

How we scored it

Legal record (65) and reserves (65) are Bybit's strongest factors: no criminal cases and monthly third-party-checked reserves. Custody (50) is the weakest because the record theft came from a cold walletCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary. For other offshore exchanges, compare OKX and Bitget, which had its own large hot-walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary breach in September 2026.