Bybit
Bybit is a cryptocurrency exchange founded in 2018 by Ben Zhou and now headquartered in Dubai, United Arab Emirates. It built its name on derivatives — perpetual futures and options with deep liquidity — before expanding into spot trading, copy trading and earn products. In February 2025 it suffered the largest crypto theft on record, about $1.4–1.5 billion in Ether, yet kept withdrawals open and replaced every affected balance, an episode that now defines how its resilience is judged.
Is Bybit safe?
Bybit's safety is best understood through the event that tested it hardest. On 21 February 2025 attackers stole roughly $1.4–1.5 billion in Ether — the largest crypto theft ever recorded — by compromising the Safe{Wallet} signing interface so that Bybit's own signers unknowingly approved a malicious cold-wallet transfer. The theft has been attributed to North Korea's Lazarus Group. What matters for a user is the outcome: Bybit kept withdrawals open throughout, replaced the missing Ether within days through a mix of company reserves, emergency loans and large deposits, and a proof-of-reserves audit by Hacken confirmed balances back above 100%. No customer lost their balance.
That response is genuinely reassuring, but it is not the same as saying nothing can go wrong. The attack showed that even a well-run exchange's signing process can be subverted, and the stolen funds themselves were largely laundered rather than recovered. As with any custodial venue, Bybit holds your keys and your own account remains a phishing target.
Bybit fees
Bybit's pricing leans into its trading-heavy audience. Spot trading is a flat 0.1% for both maker and taker orders at the base tier. Its perpetual futures — the product most people come to Bybit for — are cheaper, starting around 0.02% maker and 0.055% taker on USDT contracts, and both fall through a VIP schedule as your 30-day volume rises.
Because Bybit is built around derivatives, the futures maker rate is the number most active users should watch: posting liquidity as a maker can materially cut costs on a busy strategy. Withdrawals carry the network fee of the chain you are using, which Bybit passes through.
Incident record
On 21 February 2025 attackers manipulated the Safe{Wallet} signing interface so Bybit's multisig signers unknowingly approved a malicious transaction, draining about 401,000 ETH (roughly $1.4–1.5 billion) from a cold wallet — the largest crypto theft on record. It was attributed to North Korea's Lazarus Group. Bybit kept withdrawals running and replaced the missing Ether within days via reserves, emergency loans and large deposits; a Hacken proof-of-reserves audit confirmed assets back above 100%. No customer balances were lost, though the stolen funds themselves were largely laundered rather than recovered.
In our ratings
Where we score Bybit against its peers on open data. The number lives there, not here.
Compare with
Frequently asked
Is Bybit safe?+
Bybit survived the largest crypto theft on record in February 2025 without any customer losing a balance: it kept withdrawals open and replaced the ~$1.4–1.5B in stolen Ether within days from reserves, loans and deposits, verified by a proof-of-reserves audit. The residual risks are the custodial ones — it holds your keys and your account can be phished.
Was Bybit hacked?+
Yes. On 21 February 2025 attackers compromised the Safe{Wallet} signing interface and drained about $1.4–1.5 billion in Ether from a cold wallet, attributed to North Korea's Lazarus Group. It was the largest crypto theft ever, but Bybit made all affected users whole.
Where is Bybit based?+
Bybit was founded in 2018 by Ben Zhou and now runs its global headquarters from Dubai, United Arab Emirates, where it opened its main office in 2023.
How much are Bybit's fees?+
Spot trading is a flat 0.1% maker and taker at the base tier. Perpetual futures start around 0.02% maker and 0.055% taker on USDT contracts, both dropping through VIP volume tiers, plus network fees on withdrawals.
What changed
- 2026-09-28Profile created: founding and Dubai HQ facts, derivatives-focused fees, and the February 2025 record Ether theft with a confirmed made-whole verdict.