Bybit review: after the $1.46 billion hack, is it safe enough for Bitcoin and Ether derivatives?
Bybit lost about $1.46 billion in February 2025 and covered every withdrawal within days. We weighed the recovery, proof of reserves, fees and the patchwork of licences to judge whether derivatives traders should trust it.
7.1/10
Bybit is a deep, fast derivatives venue whose crisis handling after the February 2025 hack was better than most exchanges could manage: reserves were restored within 72 hours and withdrawals kept moving. That does not remove the custody risk that produced the hack. Fees are competitive at 0.1% spot and 0.055% perpetual taker, but regional licensing is fragmented and the interface is heavy. Keep only trading capital on it and never treat it as storage.
Best for
Experienced traders using Bitcoin and Ether perpetuals who keep only trading funds on-exchange
US, Canada, Singapore, Hong Kong, mainland China; UK spot only
The question is not whether it was hacked
Bybit was hacked. In February 2025 attackers took roughly $1.46 billion, mostly Ether and staked-Ether tokens, through a compromised signing interface tied to a third-party wallet provider. Blockchain analysts and the FBI attributed it to North Korea's Lazarus Group. It remains the largest exchange theft on record.
The Wikipedia entry for the exchange, pictured at the top of this review, gives the hack its own subsection under History, which tells you how central it now is to the company's story.
So the useful question is different. Does an exchange that survived that day deserve your derivatives margin? We compared the public record with the fee schedule to find out. These are figures gathered from outside sources, not results from our own funded accounts, so check current numbers before you rely on them.
What happened next is the best argument for Bybit
Within 72 hours Bybit had bridged its reserves back to full coverage, borrowing about 447,000 ETH from partners including Galaxy Digital, FalconX and Wintermute. One review reports that 99.994% of about 350,000 withdrawal requests were processed within ten hours. Most exchanges in a comparable position would have frozen withdrawals.
That is competence in a crisis. It is not proof of safe custody. The failure came from how a multi-signature transfer was approved, and an exchange that controls billions in a few wallets has that risk by design. Bybit now publishes monthly proof of reserves with a third-party assessment and Merkle-tree verification. Useful, but limited: it shows assets existed at a snapshot, not that liabilities are fully counted.
bybit.com
CoinMarketCap's Bybit profile: second by volume, more than 60 million users, spot and derivatives listed.
Fees at the base tier
Spot costs 0.10% for makers and takers. Perpetuals and futures cost 0.02% maker and 0.055% taker. Options run 0.02% maker and 0.03% taker. Volume tiers cut those numbers, and holding assets on the platform can as well.
For a trader turning over $100,000 of Bitcoin perpetual notional, a taker round trip at 0.055% each way costs $110. Funding payments every eight hours are separate, and you can pay them for days when the market is one-sided. The fee is the smaller part of the bill in a crowded long.
In the EU, entry-level spot taker fees are reported at about 0.25%, which is more than the global schedule. The lesson: your location changes your product, your fee and your regulator.
A patchwork of jurisdictions
Bybit Global excludes the US, Canada, Singapore, Hong Kong and mainland China. It left the UK in 2021 after the FCA's ban on retail crypto derivatives and returned in December 2025 with spot trading only. The Netherlands fined it 2.25 million euros in 2024 for operating without a licence, and India fined it in January 2025. An Austrian entity received MiCA authorisation in May 2025.
bybit.com
DefiLlama's Bybit page charts the exchange's tracked assets and links a methodology note.
Check which entity you are signing with. A regulated European account and a global account are different contracts with different protections.
The account design that can bite
Unified Trading Accounts share collateral across spot and derivatives. That is efficient, and it also means a bad futures night can force the sale of spot coins you meant to hold. Collateral is valued with haircuts, so your buying power is less than the market value of what you deposit.
The interface has plenty of tools: copy trading, grid and DCA bots, earn products. It is also dense. A beginner should start on spot with small size and skip leverage until they can explain their own liquidation price.
bybit.com
The App Store listing names Bybit Fintech Limited as developer and shows the mobile trading screens.
bybit.com
The Google Play listing shows the same app on Android under the title 'Bybit: New Financial Platform'.
The Android listing tells the same story: the app is free, with a full set of exchange screens behind a single login. It is one app for spot, derivatives and earn products, which is convenient and also means one phone holds the keys to all of it. Use a hardware key or an authenticator app for two-factor login, set a withdrawal address whitelist, and treat any support message asking for a code as an attack.
Who should skip it
Skip Bybit if you live in a restricted region, want a simple app, or cannot accept the risk of any centralised exchange. Skip it as a place to hold coins. Use it, if you use it at all, for margin you can afford to lose, and withdraw the rest to your own wallet.
Verdict
A 7.1 rewards a strong product and a strong recovery, and holds back points for the custody lesson. Leveraged crypto trading can wipe out your whole balance, and this review is not personal advice.
6.4
Gemini review: does compliance-first justify higher fees than Kraken or Coinbase Advanced?
