Is Bybit Safe? The $1.46B Hack, Proof of Reserves & Licenses Reviewed

The short answer

Yes, Bybit is safe to use — with context you should understand first. It's a 2018-vintage exchange, top three in derivatives volume, and in February 2025 it absorbed the largest theft in crypto history without a single user losing money. Reserves were back to 1:1 within about a week, confirmed by third-party auditors. The honest framing isn't "never been hacked." It's "hit harder than any exchange ever, and handled it better than almost anyone expected."

Three caveats. It doesn't serve US users, and some features are region-locked. Its core strength is futures — leveraged products that can wipe you out regardless of venue safety. And the 2025 incident exposed supply-chain risk no exchange can fully eliminate. Who it's for: experienced traders, especially derivatives-heavy ones. If you only want to buy spot and hold, you don't need Bybit specifically.

What Bybit actually is

Bybit built its name on USDT perpetuals and inverse contracts, and its matching engine still has a strong reputation among futures traders. It has since filled out spot, earn, copy trading, and an on-chain wallet — a full-stack platform now. If you sign up, type the official domain yourself rather than clicking a search ad.

The February 2025 hack: a full account

Any honest answer runs straight through this event — the biggest theft crypto has ever seen.

What happened

On February 21, 2025, attackers drained roughly $1.46 billion — around 400,000 ETH and stETH — from one of Bybit's cold wallet setups. No previous exchange hack came close.

Crucially, Bybit's own systems were not breached. The weak link was the multisig provider Safe{Wallet}: attackers compromised its signing interface, so signers saw a routine transfer on screen while actually approving a transaction that handed wallet control to the attackers. What you see and what you sign were two different things — that gap was the entire exploit. The FBI later attributed the attack to Lazarus Group, a North Korean state hacking crew.

How Bybit responded

That same evening, CEO Ben Zhou went live to disclose the incident in detail, no hedging. Two decisions mattered most:

• Withdrawals never stopped. Through a bank run of hundreds of thousands of withdrawal requests in a matter of hours, the platform kept processing them. Staying open defused the panic better than any statement could;
• The company ate the loss. Treasury funds plus bridge loans covered the hole; customer balances were untouched. Roughly a week later, third-party audits confirmed 1:1 backing was restored.

Did users lose anything

No — the single most important fact in this article. No balance haircuts, no "socialized losses," no IOU tokens. Compare that with exchanges that went straight into bankruptcy over far smaller incidents: Bybit's response is now the industry reference case for crisis handling.

Fairness requires one caveat: the hack proved even a top-tier platform has supply-chain blind spots — Safe's compromised interface made Bybit a victim too. No exchange can promise this attack class is impossible; the difference is whether the platform can and will make users whole afterward.

Asset protection and regulation

On reserves: Bybit publishes externally audited proof-of-reserves monthly, and you can verify your account's inclusion in the Merkle tree. The cadence didn't break after 2025, and the ratio has stayed at 1:1.

On licenses, it holds approvals from Dubai's VARA, CySEC in Cyprus, and Kazakhstan's AIFC, among others. The record isn't spotless: it exited Canada in 2023 via settlement with the Ontario Securities Commission, and Japan's FSA flagged it that year for operating unregistered — remediation has followed. One thing is unambiguous: Bybit does not serve the United States. Don't sneak past KYC with a VPN; frozen accounts are a real outcome.

What real users complain about

Skip the praise — here's what comes up repeatedly in trading communities:

• Liquidation disputes. In violent markets, users report stop-outs that don't match the visible book, or wicks that trigger liquidations seconds before price recovers. Every futures venue gets this complaint; Bybit's huge derivatives base makes it louder;
• Copy trading losses. Lead traders blowing up on high leverage is a recurring story. The feature works as designed — handing your position sizing to a stranger is the risky part;
• Regional restrictions. Parts of the platform are unavailable depending on jurisdiction. Read the terms for your region before depositing;
• Support queues. Non-English support can be slow at peak times; complex issues go through a ticket line.

None of these are custody risks, but you should know them anyway.

Who it's for, and who should look elsewhere

A good fit if you trade futures actively, care about execution and depth, and weight "made users whole under maximum stress" heavily in your trust math. A poor fit if you're in the US or another restricted region, if you're a beginner who only wants spot, or if you don't understand liquidation mechanics — no security record protects you from 50x leverage.

Worth comparing before committing: Binance has the deepest liquidity and widest listings; OKX matches Bybit on derivatives and has an excellent Web3 wallet; Gate.io lists the most tokens for long-tail altcoin traders. All three publish monthly proof of reserves. Whatever you choose, splitting funds across venues is risk management in itself.

If you use it, do these security steps first

1. Enable 2FA with an authenticator app or hardware key — not SMS, which is vulnerable to SIM-swapping;
2. Set your anti-phishing code: official emails will carry your personal marker. Anything "from Bybit" without it goes straight to trash;
3. Turn on the withdrawal address whitelist: funds can only go to pre-registered addresses, so a leaked password alone can't drain you;
4. Minimize API permissions: if you run bots, enable trading only, never withdrawals, and lock the key to fixed IPs;
5. Test with small amounts first: run a small deposit and withdrawal end to end before moving serious capital;
6. Treat every unsolicited DM as a scam: "support agents" and "trading mentors" who message you first are frauds. Real Bybit staff will never ask for codes, remote access, or transfers.

FAQ

Is Bybit still safe after being hacked?

By the evidence: it absorbed the largest theft in crypto history, users lost nothing, reserves returned to 1:1 within about a week, and withdrawals never paused. Security spending after that only goes up. Still, "their systems weren't breached" is no guarantee about the future — spreading funds across venues remains basic hygiene.

Did users get reimbursed for the 2025 hack?

Fully — because they never lost anything. The ~$1.46 billion gap was covered by treasury and bridge loans, balances stayed intact, and third-party audits confirmed 1:1 reserves roughly a week later.

Can I use Bybit in the US?

No. Bybit doesn't serve US users, and working around geo-restrictions with a VPN risks account closure and frozen funds. US residents should use a domestically licensed platform instead.

Which is safer, Bybit or Binance?

Both publish monthly proof of reserves, and both have survived incidents while covering losses in full — Binance's 2019 hot-wallet breach of 7,000 BTC was repaid from its SAFU fund. Binance is larger with more licenses; Bybit earned better marks for transparency and payout speed in 2025. Same tier on safety, so the choice comes down to trading style and local regulation.

Should I move my coins off Bybit into my own wallet?

Depends on the purpose. Trading capital belongs on the platform; large long-term holdings belong in a hardware wallet where you control the keys. Every exchange is a trading venue, not a vault.

Risk disclosure and affiliate notice: Crypto trading is high risk, and leveraged products can cost you your entire principal. Nothing here is investment advice. This article contains affiliate links; signing up through them may earn us a commission at no extra cost to you and does not influence our conclusions. Information is current as of October 2026 — always check Bybit's official announcements.