Is Bybit safe? Licences, account freezes and incidents
Is Bybit safe?
Bybit has 1 licence found in the ESMA MiCA register, issued by the FMA to Bybit EU GmbH. The terms that would hold its freeze clause could not be read. Its gambling clause is not verified. 1 primary-source incident is recorded, dated 2025-02-21.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with Bybit and earns nothing if you open an account there. Every statement below is read from a document Bybit publishes or from a public register, and each carries the date it was read. Corrections go to the corrections page.
Bybit review: the documents
This is a review of the documents Bybit publishes and of the registers that should list it, not a test of the platform: no account was funded and no withdrawal was run. The binding terms name Bybit EU GmbH as the company you contract with, in Austria. The global terms could not be retrieved; the record quotes 7 clauses across 5 topics from the documents that could be read. Bybit has 1 licence found in the ESMA MiCA register, issued by the FMA to Bybit EU GmbH. Its proof-of-reserves page could not be loaded, so that field is no data. The terms carry a clause on what happens to customer assets if the company fails, quoted below. Its gambling clause is not verified. 5 points could not be verified and are listed below.
Is my crypto safe on Bybit?
Bybit is a custodial exchange: coins on the account are held by the exchange, not by a key you control. What protects them is what the binding terms say about holding customer assets and about the company failing. One clause on holding customer assets is quoted below.
In accordance with Article 75(7) MiCAR, clients’ crypto-assets are kept segregated from Bybit EU’s own crypto-assets. Legally, the Custody Agreement is governed by Austrian civil law; clients remain the legal and beneficial owner of their crypto-assets and Bybit EU acts as mere factual holder, so that in an insolvency of Bybit EU clients’ crypto-assets are intended to be protected from claims of Bybit EU’s creditors. Operationally, clients’ crypto-assets are held in dedicated client wallets that are kept on-chain separate from any wallets used for Bybit EU’s own assets, and each client’s share is recorded in real time on a separate internal ledger. Ongoing monitoring and regular reconciliations are performed between on-chain holdings and the internal ledger.bybit.eu
Insolvency and bankruptcy language in the terms, verbatim:
clients remain the legal and beneficial owner of their crypto-assets and Bybit EU acts as mere factual holder, so that in an insolvency of Bybit EU clients’ crypto-assets are intended to be protected from claims of Bybit EU’s creditors.bybit.eu
Can Bybit freeze my account?
Not recorded. The document that would contain the freeze clause for most users could not be retrieved, so nothing is quoted here and nothing should be inferred from its absence.
Clients may request the withdrawal of their crypto-assets at any time up to the available balance; withdrawals are processed through automated systems, with higher-value or higher-risk withdrawals subject to additional manual review. Crypto-assets are returned in the same type of crypto-asset as held for the client; any conversion only occurs on the client’s explicit instruction under a separate service. Bybit EU maintains emergency return procedures for situations where normal withdrawal functionalities are compromised or unavailable for a prolonged period, so that crypto-assets and the means of access can be returned to clients as soon as possible (Art. 75(6) MiCAR); short maintenance windows or brief downtime do not constitute an emergency.bybit.eu
The gambling clause is not verified. The full reading is in section 10 of the review.
Has Bybit been hacked or fined?
One matter is recorded, each from the primary source linked beside it. The descriptions are the record’s, with the date. Other events may exist that no primary source in this collection confirms, so this list is not proof that there are no others.
Theft of approximately $1.5 billion in virtual assets from Bybit. The FBI issued Public Service Announcement I-022625-PSA on 26 February 2025 stating: "The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025. FBI refers to this specific North Korean malicious cyber activity as \"TraderTraitor.\"" The PSA adds: "TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency." The PSA lists 51 Ethereum addresses holding or having held assets from the theft and asks virtual asset service providers to block transactions with them.
Bybit support and scams
The official domain in the record is bybit.com. Type it yourself rather than following a link from an ad, a search result or a message, and reach support only from inside the account you signed in to there.
Real support never asks for a seed phrase or for remote access to your device. An exchange account is opened with a login, not a recovery phrase, so a request for one is a request for a wallet you hold elsewhere. A request to install a screen-sharing or remote-desktop app hands the caller your signed-in session. Either one ends the conversation.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA have each published warnings about it, quoted on crypto scam recovery: what is real.
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Bybit nor against it.
- The global bybit.com terms of service. The document could not be retrieved through any route available here. The path https://www.bybit.com/en/terms-service/ returns the Bybit homepage. The path https://www.bybit.com/en/legal/terms-and-conditions/terms-of-service returns a page whose title is Terms Of Service but whose body is fetched client side by a content system that did not respond to a headless or stealth browser with waits up to 12 seconds, nor to a plain HTTP request, nor to a request carrying the RSC header. The equivalent EU path renders as a paginated PDF viewer, of which only the first page could be captured. Consequently the account-freeze, withdrawal-suspension, forced-liquidation and arbitration clauses that bind a non-EEA Bybit user are NOT recorded in this entry and must not be inferred from the EU documents, which are governed by Austrian law and MiCA and are materially more protective.
- The identity, jurisdiction and company number of the entity that contracts with a Bybit user outside the EEA. Bybit Fintech FZE, Dubai, appears in Bybit's own marketing translation strings but not in any binding document that could be retrieved.
- Bybit's proof of reserves. No Bybit-hosted disclosure page could be loaded, so no reserve ratio, as-of date, signer or scope limitation is recorded.
- Whether the remaining 127 pages of the Bybit EU General Terms contain an account-freeze or forced-liquidation clause. Only page 1 of 128 rendered.
- Bybit's own post-mortem of the February 2025 theft. Only the FBI public service announcement is recorded, because no Bybit-hosted incident report could be retrieved.