✦Bybit: Research Notes on the Global Offering
These notes describe the global Bybit platform (bybit.com, English pages) as Squaby found it on October 21, 2026. They summarize what Bybit publishes in its terms, help center, announcements and API documentation, and what official registers, regulators and the FBI record. Squaby has not tested the platform hands-on. Bybit runs separate regional sites, among them bybit.eu for the European Economic Area, bybit.kz, bybit.tr and bybitgeorgia.ge, operated by other group companies; they are not the subject of this review, and differences are named where Squaby found them. Availability, products, payment methods and fees differ by country. The criteria, points and sources are listed in the Squaby Score section above.
1. Background
Bybit says it was founded and launched in March 2018 and that it moved its headquarters to Dubai in 2022. Its milestones page dates the launch of spot trading to July 2021; before that it offered derivatives only. Ben Zhou is named as Bybit's chief executive in the Malaysian regulator's release.
For a visitor on bybit.com, the terms name Bybit Virtual Asset Platform Operator – L.L.C – S.P.C, a company incorporated in Abu Dhabi and, according to the terms, licensed by the Capital Markets Authority of the United Arab Emirates. A second set of platform terms on the same site is provided by Bybit Technology Limited, which the global LEI register lists in the Seychelles with the former name Bybit Fintech Limited. The terms do not say which of the two documents applies to which user. The British Virgin Islands Financial Services Commission stated in October 2023 that a company named Bybit Fintech Limited had been incorporated in the BVI in 2018, struck off the register on December 10, 2021, dissolved on July 4, 2023, and had never been licensed or regulated there.
2. Enforcement Actions Since October 2021
Squaby found four actions with a payment, fine or sanction on the authorities' own pages:
✓Ontario, Canada (June 2022): the Capital Markets Tribunal approved a settlement with Bybit Fintech Limited. Bybit admitted breaches of the Ontario Securities Act, disgorged USD 2,468,910 of revenue, paid CAD 10,000 in costs before the hearing and gave an undertaking to wind down part of its Ontario business.
✓Netherlands (October 2024): De Nederlandsche Bank fined Bybit Fintech Limited EUR 2,250,000 for providing crypto services in the Netherlands without the required registration until September 2023. DNB's current overview of the proceedings shows the decision and no objection or appeal.
✓Malaysia (December 2024): the Securities Commission Malaysia reprimanded Bybit Technology Limited (previously known as Bybit Fintech Limited) and its chief executive for operating a digital asset exchange in Malaysia without registration and directed it to disable its website and apps there. The release says Bybit has complied with all directives.
✓India (January 2025): the Financial Intelligence Unit of India imposed a penalty of INR 9.27 crore on Bybit Fintech Limited under the Prevention of Money Laundering Act and gave compliance directions. Its published order does not say whether the penalty was paid or appealed; Squaby found no appeal.
The Squaby Score counts the enforcement history as concluded: none of these actions was found to be open.
Warnings without a fine are not counted in the score:
✓France: the Autorité des Marchés Financiers has listed Bybit on its blacklist since May 2022 and reminded the public of it in May 2024. Separately, the ESMA register shows the MiCA authorization of Bybit EU GmbH, the company behind bybit.eu, passported to France.
✓Japan: the Financial Services Agency warned Bybit Fintech Limited for carrying on crypto-asset exchange business without registration on March 31, 2023 and on November 28, 2024 (and earlier, in May 2021). Bybit announced that it completed its measures for residents of Japan on July 22, 2026; withdrawals and limited conversions remain available to them.
A civil lawsuit that the FTX bankruptcy estate filed in November 2023 is not an enforcement action and is not counted. Squaby searched the authorities named above; it did not search the sites of regulators in Hong Kong, Türkiye, Lithuania, Argentina, Brazil, Kazakhstan or the United States.
3. Registrations, Licenses and Restricted Countries
Squaby confirmed two regimes in official registers:
✓European Union (MiCA): the interim register of the European Securities and Markets Authority lists Bybit EU GmbH (Vienna, competent authority the Austrian Financial Market Authority, FMA), authorized on May 28, 2025 for custody, exchange of crypto-assets for funds and for other crypto-assets, placing and transfer services, and passported to 29 countries. The FMA company database lists Bybit EU GmbH as a crypto-asset service provider and Bybit Payments GmbH as an Austrian e-money institution; Squaby counts the EU once. This authorization covers bybit.eu, not bybit.com.
✓United Arab Emirates (federal): the licensed companies register of the UAE Capital Market Authority lists Bybit Virtual Asset Platform Operator as active, with the license "MTF dedicated to Virtual Assets". The register shows no license number; the terms quote license number 20200000337.
Dubai's Virtual Assets Regulatory Authority lists Bybit Fintech FZE only with an in-principle approval (IPA/24/08/001, August 21, 2024). VARA states that holders of an in-principle approval may not start operations or serve clients until they receive a full license, so Squaby does not count it as a license. Other registrations that Bybit may hold, for example in Kazakhstan, were not checked and are not counted.
Legal entity: the bybit.com terms give the name and an Abu Dhabi address of Bybit Virtual Asset Platform Operator, but no company number. The UAE regulator's register shows a different address, and the second terms document gives neither address nor number for Bybit Technology Limited. The score therefore does not award the legal entity criterion.
Restricted countries: the Bybit Virtual Asset Platform Operator terms exclude, among others, the United States, mainland China, Hong Kong, Singapore, Canada, France, the United Kingdom, Dubai, North Korea, Cuba, Iran, Uzbekistan, Sudan and Syria. The Bybit Technology Limited terms have a different list that includes Australia and does not name the United Kingdom or Dubai. Bybit may also restrict products by country of residence. Check what applies where you live before registering.
4. Security and Custody
✓Proof of reserves: Bybit publishes monthly proof of reserves reports by Hacken. The latest, with a snapshot of September 23, 2026 and a report dated September 29, 2026, states full coverage of user liabilities for the in-scope assets. Users can check that their balance is included through a Merkle tree, on a page that needs an account or with an open-source tool. Hacken notes that the report is a point-in-time verification of on-chain assets, not a financial audit.
✓The February 2025 theft: on February 21, 2025, about $1.46 billion in ETH, stETH, cmETH and mETH was stolen from one of Bybit's Ethereum cold wallets. The FBI attributes the theft to North Korea and calls the activity "TraderTraitor". Bybit says that reports by Sygnia Labs and Verichains found malicious code on the platform of its wallet provider, Safe{Wallet}, and no vulnerability in Bybit's own systems; Squaby did not read those reports. Bybit says withdrawals were not halted, that it processed about $4 billion in withdrawals afterwards, and that it closed the gap in client ETH within 72 hours with the help of Galaxy Digital, FalconX, Wintermute and others, followed by an updated proof of reserves report on February 24, 2025. The score treats the theft as an incident with a loss of assets held for customers that was made good in full. Squaby found no other incident with customer losses since October 2021.
✓Custody: Bybit's deposit FAQ says customer deposits are kept in multi-signature offline (cold) wallets, segregated from its operating budget, with a small share online; the same page says both "100%" and "the majority", and no verified percentage is published. Bybit's terms say custody assets are segregated from Bybit's own assets and that balances are not protected by any deposit protection or deposit insurance scheme.
✓Insurance Fund: Bybit publishes the rules and daily balances of an Insurance Fund that absorbs losses when liquidated futures positions close worse than their bankruptcy price; if it is not enough, auto-deleveraging applies. It protects futures traders, not customer deposits.
✓Institutional custody: Bybit's institutional clients can keep assets with Zodia Custody (announced in April 2025) or Sygnum Bank (announced in September 2025) and trade on Bybit against balances mirrored on the exchange. Squaby did not review these arrangements.
✓Account security: authenticator-app two-factor authentication, FIDO passkeys, a 24-hour lock on newly added withdrawal addresses and an option to allow withdrawals only to addresses in the address book.
5. Fees
✓Spot: the fee schedule lists 0.10% maker and 0.10% taker for regular users on crypto pairs, lower rates for VIP tiers set by asset balance or 30-day volume, and 0.15% maker and 0.20% taker for fiat pairs. Paying fees in MNT gives a discount. Bybit says rates may vary by region and that the rate after identity verification is shown on the "My Fee Rate" page.
✓Futures: regular users pay 0.02% maker and 0.055% taker.
✓Convert: no trading fee is charged, but the rate comes from market makers and may differ from the spot price; Bybit does not state what is added.
✓Deposits and withdrawals: on-chain crypto deposits are free. Withdrawal fees and minimums for each coin and network are on a public page. Fiat deposit fees depend on the currency and method; Bybit's FAQ names a flat $11 per deposit for one provider, and the methods shown on the deposit page carry percentage fees. Squaby found no free bank deposit method on a public page.
✓Fee overview: trading, crypto withdrawal and fiat fees are on different pages, and the full fiat fee list is shown only after logging in, so there is no single public fee schedule.
6. Markets, Products and Tools
✓Assets: Bybit's public list of spot instruments had 527 trading pairs with 390 distinct base assets, 11 of them tokenized stocks; Squaby counts the remaining 379 crypto assets. Derivatives contracts are not counted. Squaby does not score liquidity.
✓Products: spot trading, spot margin, perpetual futures, futures and options, earn products and crypto loans, all subject to restrictions by country of residence. Derivatives and margin trading carry a high risk of rapid losses and are not a recommendation.
✓Order types: market, limit and conditional orders, take profit and stop loss, iceberg, post-only, trailing stop, TWAP, scaled and chase orders, with OCO orders on the spot market.
✓API: Bybit's V5 API documentation allows 600 requests within a 5-second window per IP by default and no more than 500 WebSocket connections within 5 minutes; per-account limits are published separately.
✓Listing and delisting: Bybit's Token Management Rules set disclosure duties for projects and name the criteria it uses to evaluate listed tokens, such as liquidity, market capitalization, spreads, order book depth and volume. A separate article describes the delisting procedure. No thresholds are published, and Squaby did not find the criteria for new listings.
7. Support, Payments and Usability
✓Support: Bybit states 24/7 customer support. Its chat starts with an AI assistant that can hand a case to a live agent, and a case form is available; Bybit says it responds to tickets within 3 to 7 working days. Squaby found no support phone number and no platform-wide status page; a public page shows the deposit and withdrawal status of each coin. The terms give a complaints e-mail address but no published complaints procedure, response target or external escalation route.
✓Verification: Bybit says identity verification generally takes about 15 minutes and can take up to 48 hours.
✓Fiat currencies and methods: Bybit's fiat deposit article lists 19 currencies, with methods that depend on the currency, for example SEPA for EUR in some EU countries, FPS for GBP, SWIFT, bank cards, PIX, BLIK and QR payments. Marketing pages mention 65 or more currencies, but no list of them is public. 17 currencies can be withdrawn by bank transfer or Zen.com. Deposit and withdrawal limits are published per verification type and VIP level. Peer-to-peer trading and card purchases through third-party providers also exist and carry their own fees and risks.
✓Apps and languages: Bybit publishes apps for iOS and Android, and bybit.com exists in 12 languages. Bybit Learn offers articles for newcomers, and Convert and One-Click Buy offer a simpler way to buy beside the trading screens.