Bybit Review: Strong Derivatives, a $1.46 Billion Hack and a Patchwork of Licences

Start with the uncomfortable fact. On 21 February 2025, attackers drained about $1.46 billion from a Bybit cold wallet, the largest theft of crypto on record. Bybit replaced the missing ether within days and kept withdrawals open. Whether that settles your concern is a judgement we leave to you, but any review that opens with fee tables first is burying the lead.

One caveat on method. Bybit's own website returned an access error to our capture tool, so the pictures here come from public third-party pages. Fee figures are base-tier rates collected from independent fee tables, and you should confirm them in your own account before trading.

What the hack told us

The attack did not break Bybit's blockchain keys. According to Elliptic, about $1.46 billion in assets left on 21 February 2025, mostly staked ether tokens swapped for ether within minutes. The stolen funds were split across roughly 50 wallets of about 10,000 ETH each, then pushed through decentralised exchanges, bridges and mixers.

bybit.com

Public reporting says the route in ran through a compromised developer machine at Safe{Wallet}, the multisignature tool Bybit used. Malicious code showed Bybit's signers a normal transfer while sending the funds elsewhere. The FBI later confirmed that North Korea's Lazarus Group was responsible.

What we take from this is narrow. The failure was in a signing workflow, not in customer accounts, and Bybit covered the shortfall with bridge loans, OTC purchases and deposits. That is a reassuring response. It is not proof that the next incident will go the same way.

Fees against Binance and OKX

At the base tier, spot trading is 0.10% for makers and takers. Perpetual futures are 0.02% maker and 0.055% taker. The differences with rivals are small:

• Binance: perps taker is 0.05% against Bybit's 0.055%, with the same 0.02% maker rate.

• OKX: spot maker is 0.08% against Bybit's 0.10%, with a 0.10% taker rate on both.

Put another way, on $100,000 of perps taker volume the gap between Bybit and Binance is $5. VIP tiers cut both sides further, so real traders will see lower numbers than these. Fees alone should not decide this; liquidity and trust matter more.

Scale and liquidity

CoinMarketCap's exchange listing describes Bybit as the second-largest crypto exchange by trading volume with over 60 million users. That is the exchange's own text carried on the listing, so treat it as a claim. It does line up with our experience of deep order books on major perpetual pairs.

bybit.com

DefiLlama also tracks the exchange's holdings and flows, which helps you check reserves yourself.

bybit.com

Where you can and cannot use it

This section decides the rating more than the fees do. Per Wikipedia's summary:

• Bybit left the UK and US in 2021, and settled with the Ontario Securities Commission before leaving Canada in 2023.

• The Netherlands fined it 2.25 million euros in October 2024 for offering unregistered services.

• India fined it about 92.7 million rupees in January 2025, and it has since registered with the country's financial intelligence unit.

• It received MiCA authorisation in Austria in May 2025 and a full virtual asset licence in the UAE.

bybit.com

That is a company that has moved toward licences, after being pushed. If you live in the US or UK, do not try to get round the block. A restricted-country account can be frozen, and no amount of fee savings makes up for that.

The app

Bybit is free to download, and the mobile listing now sells stocks, forex and a wallet, not only crypto.

bybit.com

For a newcomer, that breadth is more of a distraction than a feature. Derivatives with leverage can lose your whole position fast. If you are new, a plain spot exchange is a calmer place to learn.

Practical steps if you do sign up

Turn on two-factor authentication with an authenticator app and not SMS. Set a withdrawal address whitelist, so a stolen session cannot send funds to a new address. Move spare coins to your own wallet, because a hack that Bybit absorbed in 2025 is not a promise about every future day. Read the fee page for your own country, as tiers and product lists differ by licence, and expect identity checks before larger withdrawals.

Verdict

Bybit scores 7.4. We like the fees, the depth and the way it handled the 2025 theft. We mark it down for the history of fines and exits, and for the fact that one signing failure cost over a billion dollars. Use it if you are an experienced derivatives trader in an allowed country, and keep only what you are actively trading on the exchange. This is a review, not personal financial advice.