Bybit Review 2026: Fees, the Card, the Bots and the Hack

I have had a Bybit account for a bit over five years. Not opened for a review — used: buying spot, paying for groceries and flights with the Bybit card, running a grid bot and a DCA bot in the background, and, in February 2025, watching from the inside what an exchange does on the day it loses $1.46 billion. This article is what five years of that taught me, with every number re-checked against Bybit’s own help pages and public market data in August 2026.

This site’s default position on exchanges has not changed and is not about to. Coins you intend to hold for years belong in your own custody, and not your keys, not your coins is the correct instinct to have carried out of 2022. But almost nobody’s coins start in self-custody, and for most people some money never leaves the exchange at all — the balance the card spends from, the stablecoins a bot is trading with, the float waiting for a buy. That balance deserves the same treatment as everything else here: numbers instead of adjectives, and a section listing what is wrong with it. I write and run the whole of this site myself, which is why the disclosure below is longer than usual.

Disclosure: this article contains a referral link to Bybit. If you open an account through it you may qualify for the signup tasks described near the end — bonuses that cannot be withdrawn, only used as trading margin, and worth 10 to 25 USDT in the realistic case; how much, and whether anything at all, depends on your region and on which campaign is running that week — and this site receives a share of the trading fees you later pay. It costs you nothing extra: the fee schedule is identical whether you use the link or type bybit.com into your browser. Bybit did not commission this article, did not see it before publication and has no say over its contents, including the section listing what I do not like and the section about the money it lost.

Short version:

• Size. CoinGecko’s Q2 2026 data has Bybit second among the top ten spot venues; the same firm’s 2025 annual report ranked it third for the year — the label depends on the window.
• Fees. Ordinary and occasionally worse than ordinary: 0.10% on both sides of a crypto spot pair at the base tier, but 0.20% to take and 0.15% to make on fiat pairs until you have traded $100,000 in a month.
• The card is the reason I am still here — it converts crypto automatically, sits in Google Pay and pays 2% back, capped at $5 a month at the entry tier, with the headline 10% reserved for people spending $25,000 a month. There is a 2% charge on anything that does not settle in dollars, and no Apple Pay.
• The bots carry no subscription and no share of profit — you pay ordinary trading fees on every order, which for a frequently trading grid bot is the real cost.
• Earn’s advertised 6.72% on tether applies to your first 200 USDT and drops to 1.72% above it.
• The hack. In February 2025 the exchange lost $1.46 billion to North Korean attackers, kept paying withdrawals through the same day and had reserves back to 1:1 within 72 hours. Customers lost nothing, because the company’s own balance sheet absorbed it.

That last line is a fact about 2025, not a promise about the next time.

If that is enough to decide on, opening an account through my referral link puts you in whatever signup campaign is live in your region and gets this site a share of the fees you pay. Everything between here and there is the detail, including the reasons not to.

What Bybit is (and what it is not)

Bybit was founded in 2018, is run by its co-founder Ben Zhou and is headquartered in Dubai. It said it had passed 80 million registered users in a January 2026 press release recapping 2025 — a registration count published by the company itself, which is a marketing number in every exchange’s hands and not an audited one.

The size claim that can be checked is volume. Across the second quarter of 2026 Bybit took 10.0% of the spot trading done by the ten largest centralised exchanges, second only to Binance, up from 9.5% in December 2025 — though CoinGecko’s own 2025 annual report ranked it third for that year, so even the headline depends on the window you choose. A single day’s snapshot moves it around further: on 5 August 2026 it sat third among CoinGecko’s ten highest-rated venues and tenth counting every listed exchange. Treat the ranking as a quarter’s average, not a fact about today. In derivatives it is smaller than its reputation suggests — fifth by open interest, meaning the total value of derivative contracts currently open across the market, with about 6% of the total on 5 August 2026. Bybit now reports open interest single-counted rather than counting both sides, so cross-venue shares of it are rough. Anyone telling you Bybit is the number two derivatives venue is quoting something older than any of that.

What that size buys a normal user is the spread, and here the honest answer is that the top of the book is indistinguishable from the biggest venue: 0.0102% on BTC/USDT against Binance’s 0.0100% on 5 August 2026, a difference of two hundredths of a cent on a $1,000 buy. Where Bybit does not lead is quality-adjusted ranking — Kaiko’s Q2 2026 exchange ranking, which scores venues on governance, technology, data quality, security and liquidity rather than raw turnover, put Crypto.com, Coinbase and Bitstamp in its top three. Bybit ranks by volume, not by institutional respectability, and those are different products.

It is licensed, in the specific and limited way exchanges are. In the EU, Bybit EU GmbH holds a MiCA licence as a crypto-asset service provider granted by the Austrian regulator on 28 May 2025 — covering 29 countries but only 5 of the 10 regulated services, which is why there are no futures for EU customers — and a separate Austrian e-money licence followed on 4 August 2026. Outside the EU it holds a full UAE securities regulator licence since October 2025, registration as a VASP — a virtual asset service provider, the registration a crypto business needs before it can legally serve customers in a given country — with the National Bank of Georgia since November 2024, an AFSA licence in Kazakhstan, and registration with India’s financial intelligence unit after a ₹9.27 crore penalty, about $1.06 million, ordered on 31 January 2025. Dubai is the entry to read carefully: what Bybit holds there is a VARA in-principle approval, not yet an operating licence. It does not appear on VARA’s public register, and its UAE entity excludes Dubai residents. Since 19 January 2026 new users of the global platform are onboarded onto the UAE entity, and UAE residents pay 5% VAT on their trading fees as a result.

One thing it is not, and the confusion is worth heading off early: Bybit’s insurance fund, about $1.0 billion on 5 August 2026, is not deposit insurance. Bybit’s own page for it is scoped entirely to futures liquidations: the fund exists to absorb the losses of bankrupt leveraged positions so that profitable traders on the other side still get paid, and deposit protection is not mentioned anywhere on it. It has nothing to do with your spot balance, and no scheme anywhere covers that balance. There is no FDIC here, no FSCS, and no equivalent.

The February 2025 Bybit hack, and why I stayed

On 21 February 2025 Bybit lost $1.46 billion in a single transaction out of one cold wallet — a wallet whose signing keys are kept offline, which is supposed to be the safest thing an exchange owns. The contents were 401,347 ETH plus about 113,000 ETH-worth of staked and re-staked variants — 90,375 stETH, 15,000 cmETH and 8,000 mETH, which are receipts for ether staked elsewhere. It remains the largest theft in the history of the industry by a wide margin.

The mechanism matters, because it was not a break-in at Bybit. The wallet was a multisig — an arrangement requiring several independent people to sign before funds can move — operated through Safe{Wallet}, a third-party service. Attackers compromised Safe’s own infrastructure and served malicious JavaScript that showed Bybit’s signers one transaction on screen while they were signing another. The forensic reports commissioned afterwards, from Sygnia and Verichains, both traced the root cause to that JavaScript served from Safe{Wallet}’s infrastructure; Sygnia states it found no evidence that Bybit’s systems were compromised. The FBI attributed the theft to North Korea, to the group it tracks as TraderTraitor.

What happened next is the whole reason this article exists. Withdrawals were never paused. Bybit says it processed 99.994% of more than 350,000 withdrawal requests within ten hours, at the exact moment when halting them would have been the cheap and obvious move. It raised $1.23 billion in bridge loans, whale deposits and over-the-counter purchases, with Galaxy Digital, FalconX and Wintermute among the counterparties, and Bitget lent it 40,000 ETH outright. Within 72 hours reserves were back to 1:1 against customer balances, verified on 24 February 2025 by an independent proof-of-reserves audit from Hacken — proof of reserves being a check, published as a Merkle tree so each customer can verify their own balance is included, that the exchange actually holds at least as much of each coin as it owes.

Customers lost nothing. The $1.46 billion came off the company’s balance sheet, and the market’s verdict was visible in the volume: Bybit’s share of top-ten spot trading fell to about 6% in March 2025 and had climbed back to 10.0% by the second quarter of 2026. The stolen money mostly did not come back. Bybit ran a bounty site paying 10% of the value of whatever gets frozen — half for tracing it, half for freezing it — from a pool of up to $140 million; by 12 September 2025 some $73 million had been frozen, under $30 million actually returned, and more than $1 billion sat with parties that never responded, which is untraceable in practice rather than provably laundered. The mixer trail Bybit publishes accounts for about $260 million of it.

So the sentence I would use is not that Bybit has a good reputation. It is that Bybit has a reputation that was tested against the worst case the industry has produced, and held. But the honest reading of why it held is uncomfortable: it held because the company was profitable enough to eat a $1.46 billion loss and connected enough to borrow $1.23 billion inside a day. If the same attack landed on a thinner year, or for twice the amount, the arithmetic could easily have gone the other way — and then the withdrawal queue would have been the story. Which is the entire argument for keeping coins you plan to hold for years off any exchange, including this one.

Bybit fees: what trading actually costs

At the base tier, spot trading costs 0.10% whether you are the maker — the side whose order sits on the order book waiting and adds liquidity — or the taker, the side that fills against an order already there and removes it. That is the standard number across the industry, and it is what most readers of this article will pay.

The trap sits one step to the side of that chart, and it catches exactly the people least able to notice. Spot pairs quoted in fiat currency are not priced at 0.10%: below $100,000 of 30-day volume they cost 0.20% to take and 0.15% to make — double and half again the crypto-pair rate, and the taker leg stays at 0.20% until $275,000 of monthly volume. So the beginner buying bitcoin with euros through the fiat order book pays the worst price on the menu, while the same purchase routed through a stablecoin pair pays the standard one. Nothing in the interface shouts about this.

Perpetual futures and dated futures cost 0.055% to take and 0.020% to make. On top of that sits the funding fee — a payment exchanged directly between the holders of long and short positions every few hours to keep the perpetual contract’s price tethered to spot. It is not Bybit’s fee and Bybit does not keep it, but it is a real and sometimes large cost of holding a position, and it is worth understanding before you hold one overnight. The step up to the first VIP tier needs either $100,000 of assets or $1 million of spot volume in 30 days, which is to say that most readers of this article will never see a discount and should plan on the base rate.

The rest of the schedule, briefly. Crypto deposits are free, and withdrawals are the subject of the next section. Peer-to-peer trading is free of Bybit fees except in a handful of currencies — Nigerian naira, Azerbaijani manat, Russian rouble, Ghanaian cedi and Tajik somoni — where the rouble market, for instance, charges the selling maker 0.25% to 0.3%. One-Click Buy shows the payment provider’s fee at checkout and Bybit does not publish its own take on that route, so any specific percentage you find for it in another review is a guess. And the liquidation fee, the charge for having a leveraged position closed out for you, is zero on perpetuals and futures but 2% on spot margin.

Getting the coins out

The whole argument of this site is that coins you plan to hold belong in your own custody, which makes the last leg — buy here, move it out — the part of the process that actually matters. Three things decide what it costs and how long it takes.

The network, not the coin. Withdrawal fees are fixed per coin and per network, and Bybit no longer publishes them as a table: the number appears in the withdrawal window, one screen before you confirm. That is late, but it is before you commit, and it is the screen that decides the cost. The same tether can cost cents on one network and several dollars on another, so on a small transfer the network selector is the easiest way there is to pay several times what you needed to. Check that your receiving wallet supports the network you picked before you send — that mistake is not a fee, it is a loss.

The 24-hour hold. Withdrawals are suspended for a day after a list of security events, and Bybit’s help page on unsuccessful withdrawal requests names them: changing your password, email address or phone number, switching off two-factor authentication, changing the fund password, self-reactivating a disabled account, or deleting passkeys. Assets bought through Buy Crypto can also be held while risk checks run. None of that is unreasonable and all of it is infuriating on the day the money has to move, so the fix is scheduling rather than argument: if you have just touched a security setting, plan the funding leg a day ahead.

Verification sets the ceiling. An unverified account can withdraw crypto up to 20,000 USDT a day and do essentially nothing else. Standard verification lifts that to 1 million USDT a day, which is well past the point where the limit is anyone’s problem.

The Bybit card, and the cashback cap nobody mentions

This is the part I would miss most, and the part I have the sharpest complaints about. Georgia, where I live, is its own line in Bybit’s official card table: a Mastercard issued as a credit card with the account denominated in US dollars. The virtual card is free and arrives immediately, the physical one costs 29.99 USDT once, and there is no annual fee on either. It funds itself from BTC, ETH, XRP, USDT, USDC or GRAM, and you set the order in which those get sold. Practically, this means I can pay for a flight from a stablecoin balance without planning a withdrawal to a bank three days earlier, and that convenience is genuine.

It is also not free, and the fees stack in a way that is easy to miss because none of them appears as a line on the receipt. Selling the crypto to fund the transaction happens at the One-Click Sell rate plus 0.9% — and One-Click Sell is Bybit’s own quote rather than the spot order book, so the 0.9% is the visible layer on top of a spread you never see quoted. The $1 figure in the fee table is a minimum conversion amount, not a minimum charge: a $4 purchase converts $4 and costs about four cents, and a purchase under $1 converts $1 and leaves the change sitting as fiat in the funding account. Then there is a 2% foreign exchange fee on anything not settled in US dollars. In Georgia, where every local merchant settles in lari, that 2% lands on essentially every purchase I make at home. The result is a card that is genuinely good for travel and for online spending priced in dollars, and mediocre in a Tbilisi supermarket. I keep it for the first two and use a local bank card for the third, and if you are picking a card for daily domestic spending in a non-dollar country, this one is not it.

Cash costs money too: the first $100 of ATM withdrawals each month is free and everything after that costs 2%, inside limits of $1,000 a day and $10,000 a month. Ordinary spending is capped at $15,000 a day and $65,000 a month. The card works in Google Pay and Samsung Pay but not in Apple Pay, which is what Bybit’s own card FAQ says as of 29 July 2026 and is the single most common disappointment I hear about it. And the card needs a higher identity check than the exchange itself — Advanced or Pro verification, not the basic level.

Two things the chart cannot show you. Cashback is paid in USDT if you switch on Auto Cashback, and it is not paid at all on ATM withdrawals, on fees or on transfers, which are excluded by merchant category; a promotion running from 15 July to 15 September 2026 doubled the rate on travel spending. Realistically, for someone spending normal amounts, this is a card that returns a few dollars a month, and the honest reason to want it is the automatic crypto conversion rather than the rewards.

One line for readers in the European Economic Area, since it is not my situation and I cannot test it: the card there has moved to a separate entity and a separate site, bybit.eu, with its own terms.

The Bybit trading bots I actually run

The bot builder offers five: Spot Grid, Futures Grid, DCA, Futures Martingale and Futures Combo, with TradFi Combo sold alongside as a separate product. I run two — a spot grid and a DCA bot — and the first thing worth knowing is the pricing, because it is the unusual part. There is no subscription and no share of the profit. Bybit’s own help page puts it plainly: no other fees will be charged to create a Spot Grid Bot, and the DCA bot says the same. You pay the ordinary trading fees on the orders the bot places, which for a grid bot placing dozens of small trades a week is not nothing — the 0.10% adds up in a way a monthly subscription would not — but there is no separate rent on the automation itself. Compared with the third-party bot services that charge both a subscription and a slice of profit, that is a real difference.

The Spot Grid bot divides a price range into between 2 and 200 levels and buys lower and sells higher inside it. Because it is unleveraged spot, it cannot be liquidated; the failure mode is not a blow-up but the ordinary one — the price leaves your range and you are left holding the asset with the bot idle, which is a loss of opportunity rather than of principal. The Futures Grid bot allows 2 to 400 levels, runs Long, Short or Neutral, works on USDT perpetuals only, and it very much can be liquidated. Those are different products with a shared name, and the difference is the whole risk.

The DCA bot is the one I would recommend to a reader of this site, with caveats. It buys on a fixed schedule at intervals from 10 minutes to 4 weeks, holds up to 5 coins in a single bot, and you can run up to 50 bots at once, counting DCA and spot-grid bots together. The minimum order size is dynamic rather than fixed, so do not plan a strategy around a number you read somewhere — check it in the creation screen for your pair on the day. The setting that catches people is the default: idle funds in the bot are routed into Flexible Easy Earn automatically, and the checkbox controlling that is only offered while you are creating the bot, not afterwards. Decide at creation. It is a reasonable default and it is still a default that quietly makes you an unsecured lender to the exchange, which is the subject of the next section.

Be clear about what the bot is buying you, though, because it is not a cheaper purchase. The bot pays the same 0.10% a manual order pays, maker and taker alike, so the saving is attention rather than money — and it does not close the loop either, because no bot on any exchange withdraws to your own wallet. The last leg stays manual whatever you automate. For a monthly buy that is a small win; for a weekly one it is a real one. If you want the reasoning behind scheduled buying rather than the mechanics of the tool, that is a separate article.

The Futures Martingale bot deserves a warning rather than a description. It answers a losing position by adding to it, with a position multiplier of up to 2 and leverage of up to 50x — so each successive entry can be twice the size of the last while the price moves against you, and the position grows geometrically at exactly the moment your thesis is being disproved. Bybit’s own documentation says the strategy can lead to bigger losses. The maths is not subtle: doubling down survives every drawdown except the one that matters. I do not run it and I would not suggest anyone reading a long-term holding site does either. And one availability note for TradFi Combo: it is not offered in India, Japan, Canada, the UK, Spain, New Zealand, Uzbekistan or Singapore.

Earn, and the tier trap

The number Bybit advertises for flexible tether savings on 5 August 2026 is 6.72%. The number you get on any meaningful balance is not that. The 6.72% applies to your first 200 USDT; everything above it earns 1.72%. Put $10,000 in and the blended rate is about 1.8%. Bitcoin works the same way — 0.4% on the first 0.003 BTC and 0.1% above it, which on any real holding rounds to 0.1% — while ether pays a flat 0.8% with no tier. This is not hidden, it is written on the product page, but the tiered rate is what the headline shows and the post-tier rate is what you actually earn.

On-Chain Earn is a different mechanism and the rates are less decorative, because they come from the blockchain rather than from Bybit: 2.13% on ether through stETH with an eight-day unstaking queue, 5.29% on solana with three days, and 3.37% on tether from a 10 USDT minimum, all as of 5 August 2026. The unstaking queues are the price of the higher rate and they are not negotiable in a hurry. All of these rates float, and Bybit’s own wording is that the APR is for reference only and is not guaranteed.

Two pieces of small print matter more than any of the percentages. The first is that principal protection on Easy Earn is protection of the token amount, not of its value — you are promised your coins back, not your dollars, which is a promise about custody and not about price. The second is where the flexible yield comes from: Bybit pays it out of platform revenue. That is not staking and not lending against collateral you can see; it is Bybit’s unsecured promise, which makes your deposit a claim on the exchange itself and puts it in the same queue as everything else if the exchange ever has a bad enough week. The advanced shelf is graded, and the grades are Bybit’s own: Dual Asset, Double-Win and Smart Leverage carry its High risk label, Discount Buy and Liquidity Mining are Medium, and only Private Wealth Management is Low. I am going to leave the High-risk three at one sentence: they are structured products whose worst case is being converted into the asset you did not want at a price you did not like, and they are not what anybody comes to a long-term holding site to read about. None of this is financial advice, and I do not park coins I intend to hold for years in any of it — a yield paid out of a company’s revenue is worth exactly as much as the company. Bybit’s own European entity states the boundary in its terms: Bybit Earn is an unregulated product and not a regulated crypto-asset service under MiCAR — and, in the same passage, that assets used within Bybit Earn nonetheless remain subject to MiCAR safeguarding requirements where they are held in regulated custody. The second half materially softens the first, and quoting only the first would be the kind of half-truth this article is supposed to avoid.

KYC, EDD and the freeze question: is Bybit safe to keep money on?

Start with the country list, because it is the only part of this that is published. As of 5 August 2026 Bybit does not serve the United States, mainland China, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Sevastopol and the occupied regions of Ukraine, Sudan or Syria — plus, for the UAE entity that now onboards new global users, Dubai itself. Sanctions lists of individuals — the US SDN list, the EU and UK equivalents — apply on top of the country list and are checked against the person, not the passport’s country of issue.

That list moves, and it moves in both directions, so a country you checked two years ago is not a country you have checked. Bybit left the United Kingdom in September 2023, ahead of the financial promotions regime that took effect that October, and came back on 19 December 2025 — with roughly a hundred spot pairs and peer-to-peer trading, but no derivatives, because the retail crypto derivatives the Financial Conduct Authority banned in January 2021 are still banned. Its British marketing is now approved by Archax, an FCA-authorised firm, which is the mechanism the promotions regime requires. Japan went the other way, and is still going: new registrations stopped on 31 October 2025, a residency-classification deadline fell on 22 January 2026, and access is being restricted in stages through 2026 — the end of a run of three warnings from the Financial Services Agency in 2021, 2023 and 2024 and a request in February 2025 that the app be pulled from the stores. Hong Kong’s regulator listed Bybit as a suspicious virtual asset platform in March 2024 and Singapore’s added it to an investor alert list in June 2026 — both are warning lists rather than enforcement actions, and Bybit does not serve either market anyway.

The rest of the enforcement record is real but narrow, and the short version is enough here because the fuller list sits in the section on what I don’t like: a €2.25 million Dutch central bank fine in October 2024 for operating without the registration Dutch anti-money-laundering law requires, discounted because Bybit had already moved its Dutch customers to a registered local firm; an Ontario Securities Commission settlement in June 2022 giving up US$2,468,910, with Canadian positions wound down by 30 September 2023; a Malaysian order in December 2024 to disable the site and apps for running an unregistered exchange, which Bybit complied with and says it came off around the end of April 2026, though the regulator published no notice of that; and a $228 million settlement in October 2024 of a $953 million claim by the FTX bankruptcy estate. Against all of it, one absence deserves saying out loud because most people assume the opposite: there is no United States enforcement action against Bybit on record — no SEC case, no CFTC proceeding, no OFAC designation. It does not serve the US, and it has not been pursued there.

Since a fair number of readers of this site have moved countries recently, let me answer the passport question directly rather than leave it between the lines. Georgia is not on the restricted list. Russia and Belarus are not on it as countries either, and rouble peer-to-peer trading exists on the platform with the fee noted earlier. That is a statement about country lists and nothing more. Three filters run in sequence: the country list, the sanctions lists of named individuals, and then identity verification — and the third is the one that actually decides. Whether a given combination of passport, residence permit and utility bill gets through is a case-by-case compliance decision that Bybit does not publish rules for, and no article can answer it for you. All I can report is my own case: an account opened on Georgian residency has worked for five years without interruption. That is one data point, not a rule. If you are planning anything around an account, open it and verify it before you need it, not on the day the money has to move.

Verification itself is close to mandatory in practice — the unverified daily ceiling is the 20,000 USDT described above, and the card needs the higher Advanced or Pro level. Beyond ordinary verification sits the thing that is really behind almost every story you have read about a frozen exchange account: Enhanced Due Diligence, or EDD — a request for documented Source of Funds or Source of Wealth, meaning paperwork proving where a specific deposit came from or how you came to have money at all. Bybit describes it as a normal compliance measure, and it genuinely is one; every regulated financial institution does it. It is also, in my view, the single largest operational risk of keeping money on any centralised exchange, and it is a different kind of risk from a hack. It arrives without warning, it can hold your balance while it is resolved, the standard of proof is whatever the reviewer decides it is, and the only channel is a chat window. There is no branch, no ombudsman you would recognise, and no deadline that binds them.

There are two things you can do about that, and neither of them is arguing. The first is to have the documents before you are asked for them: a payslip or a contract for income, a bank or exchange statement for the transfer itself, and the transaction history of your own wallet if the deposit came from one. Keep them as actual files in an actual folder, not as an I-could-get-that — the review starts on a day you did not choose, and the difference between a week and a month is usually how long it takes you to find the paperwork. The second is scale. Bybit publishes neither a deadline for these reviews nor a description of how much of an account a hold covers, and that uncertainty is itself the argument for keeping the balance small: the smaller the share of your net worth sitting there when the request lands, the less a freeze is a problem and the more it is an inconvenience.

How often does it happen? Nobody can tell you honestly, and this is the paragraph where it would be easiest to launder an impression as a finding, so treat what follows as reputational background rather than as data. Bybit’s Trustpilot page on 5 August 2026 showed 2.7 out of 5 across 7,479 reviews, 50% of them one star and 38% five — a barbell rather than a distribution — and the one-star reviews are overwhelmingly about balances held during compliance checks. Three reasons not to read that as a measurement: review sites collect people with a grievance and almost nobody else, a portion of the one-star texts follow each other closely enough that they cannot all be independent accounts, and Bybit replies to roughly 99% of the negative ones, which tells you it manages the page attentively and tells you nothing about who was right in any individual case. What the page does establish is which complaint dominates, and it is this one.

The one thing Bybit does publish on solvency is a monthly proof-of-reserves attestation, with a Merkle tree so you can verify your own balance was counted. Use it for exactly what it is, and notice that its own language has been getting more careful. The firm behind it is Hacken, a Tallinn security company rather than one of the big four accounting practices, and from the July 2026 edition the exercise is described as a technical verification rather than an audit, with Bybit named as a verified entity. The report says of itself that it should not be taken as a comprehensive financial audit of assets, liabilities or the organisation’s overall financial position — which is the honest boundary, printed by the people doing the work. A snapshot shows that certain assets were held on a certain day. It says nothing about borrowings, off-balance-sheet commitments or the days in between, and Vitalik Buterin named the specific hole in 2022: an exchange shuttling the same collateral between wallets for successive checks would allow them to pretend to be solvent when they actually are not. The failures of that year were failures of the liability side, and no reserve attestation would have caught one of them.

What I don’t like

• Fiat spot pairs cost double. The person buying their first bitcoin with a bank transfer pays 0.20% to take, and the person who already knows to route through a stablecoin pair pays 0.10%. Charging beginners more than professionals for the identical trade is a choice, not a cost.
• The card is fee-heavy where I live, and there is no Apple Pay. The 2% FX charge lands on nearly every purchase in a country that settles in its own currency, and the absence of Apple Pay is a plain functional gap in 2026.
• Earn advertises a rate almost nobody receives. Quoting 6.72% for a tier that stops at 200 USDT, when the rate above it is 1.72%, is technically accurate and practically a headline that does not survive contact with a real balance.
• Withdrawal fees are no longer a published table. They live in the withdrawal window, one screen before you confirm. You cannot compare networks before you decide to move, which is precisely when you would want to.
• The app is built to sell you the next product. Perpetuals, copy trading, launchpads, campaigns, a points programme and a wheel to spin are all one tap from a spot balance. A user who wants to buy an asset and hold it has to ignore most of the interface, and the interface is designed to make that hard.
• EDD arrives without warning and support is a chat window. The compliance review that can hold your balance is a normal part of the business, but the experience of being on the receiving end is a form with no deadline and no human you can escalate to by name — and it is the complaint that dominates every public review page the exchange has.
• The regulatory file has entries in five countries. A €2.25 million Dutch fine, a Canadian settlement followed by a Canadian exit, a Malaysian order to switch the site off, a Japanese wind-down after three regulator warnings, and an Indian penalty of ₹9.27 crore before registration was granted — plus, in a bankruptcy court, a $228 million settlement with the FTX estate. None of it reached customer balances, and none of it is nothing: it is the record of a company that has more than once entered a market first and obtained permission afterwards.
• The thing that protects you is unpublished. Proof of reserves is a monthly snapshot of assets rather than an audit of solvency, and no outsider ever sees the liability side of the ledger it is drawn from. You are trusting a company, and the disclosure that would let you check the company does not exist.

Bybit vs Binance vs OKX vs Coinbase

These four are not interchangeable, which is why the notes below the table matter more than the table. Everything in it is each venue’s own published schedule or a matter of public record as at 5 August 2026.

	Bybit	Binance	OKX	Coinbase
Spot fees, entry tier	Bybit 0.10% maker and 0.10% taker on crypto pairs — but 0.15% and 0.20% on fiat pairs below $100,000 of monthly volume.	Binance 0.10% and 0.10%, falling to 0.075% if fees are paid in BNB.	OKX 0.08% maker, 0.10% taker.	Coinbase 0.60% taker, 0.40% maker on the first $10,000 of 30-⁠day volume, per Coinbase Exchange’s published schedule — Advanced Trade routes through the same order book.
Perpetual futures	Bybit 0.020% maker, 0.055% taker, plus funding paid between traders.	Binance 0.020% and 0.050%.	OKX 0.020% and 0.050%.	Coinbase Not offered to retail; its international venue runs a 0.00% maker, 0.03% taker promotion.
Card	Bybit 2% back rising to 10%, but capped at $5 a month at entry and $600 at the top. Issued for Georgia, funded from crypto, in Google Pay and Samsung Pay but not Apple Pay.	Binance Card closed for the EEA on 20 December 2023, and no official list of countries where it still works has been published since.	OKX Since 28 January 2026 the EU plus Norway — not the whole EEA, since Iceland and Liechtenstein are excluded — virtual only, with cashback paid only on spending funded by USDG and capped at €10 a month at entry, rising to €1,000 at VIP 4 and above where the rate reaches 10%.	Coinbase Up to 4% bitcoin back belongs to the US-only Coinbase One credit card, which needs a paid membership. The debit card exists in the US, UK and EEA, but its rewards are US-only.
Trading bots	Bybit Five types in the bot builder plus a separate TradFi Combo product, with no subscription and no share of profit — you pay ordinary trading fees on every order the bot places.	Binance A comparable multi-bot suite; the published count depends on how execution algorithms are tallied.	OKX A comparable multi-bot suite, likewise counted differently in different places.	Coinbase None.
EU status under MiCA	Bybit Licensed as a crypto-asset service provider by the Austrian regulator on 28 May 2025: 29 countries, 5 of the 10 services. The EU platform is a subset of the global one — 132 spot pairs against 557, no derivatives at all, and tether gone from the EU book entirely, with USDC carrying 111 of the 132 pairs.	Binance No MiCA licence; it stopped offering regulated services in the EU on 1 July 2026.	OKX Licensed in Malta under MiCA.	Coinbase Licensed in Luxembourg.
Available in Georgia	Bybit Yes, and registered as a virtual asset service provider with the National Bank of Georgia since November 2024.	Binance Yes — Georgia appears as Available on its published support-region list.	OKX Listed as available on OKX’s app-availability page, with no product-level confirmation.	Coinbase Not confirmed.
Worst item on the record	Bybit $1.46 billion stolen in February 2025; withdrawals kept running and reserves were back to 1:1 within 72 hours.	Binance A $4.32 billion settlement with the US Department of Justice in 2023; and its founder served four months and was pardoned on 23 October 2025.	OKX A guilty plea in the Southern District of New York on 24 February 2025, with penalties of about $505 million.	Coinbase A data breach affecting 69,461 customers in May 2025, after which it refused a $20 million ransom, and a €21,464,734 fine from the Central Bank of Ireland, announced in November 2025 and confirmed by the High Court in January 2026.

Reading straight across that table would mislead you in three places. The first is the incident row, which is not a like-for-like comparison of badness. Bybit’s is an operational failure that cost the company money and cost customers none. Binance’s and OKX’s are legal findings about how the businesses were run, and a criminal resolution attaches to a company for years in a way a one-off loss does not. Coinbase’s is a failure to protect data rather than money. Which of those you should weigh most depends entirely on what you are worried about.

The second is that regulatory quality and market quality are not the same axis, and Coinbase wins the first while losing the second. Its fees are four to six times Bybit’s at the entry tier and it has no bots and no card rewards outside the United States, but it is the venue with the cleanest licensing position and the one Kaiko’s quality ranking places near the top. If your priority is that the venue holding your coins is boringly supervised, that is worth paying several times the fee for. If your priority is cost and tooling, it is not.

The third is that availability quietly decides the whole question before any of the other rows get a vote. In the EEA the practical field is OKX and Coinbase, because Binance has withdrawn from regulated services and Bybit’s European platform is a visibly smaller thing than the global one: 132 spot pairs against 557, no derivatives at all while a MiFID II application — filed by a separate entity, Bybit X GmbH, and announced on 5 September 2025 — waits, and tether gone from the EU book entirely. USDC carries 111 of the 132 pairs, with the euro on 17 and the zloty on 4. New EEA users have not been able to register on the global platform since early June 2025 and existing accounts are being restricted in stages, so anyone in Europe attached to trading against tether should settle that question before comparing a single fee in the table. From Georgia, where I am, the field with a confirmed full-featured offering is two wide: Bybit and Binance. Between those two, I choose Bybit for the card that works here and the bots that add no rent on top of the trades they place, and I hold the choice loosely, because both of them are companies rather than protocols.

Who Bybit fits (and who it doesn’t)

It fits if you recognise yourself here:

• You want a working balance that can be spent from a card without a three-day round trip through a bank.
• You want scheduled buying or a grid strategy automated, and you do not want to pay a third party a subscription plus a cut of the profit for it.
• You live somewhere the large regulated venues do not properly serve, and the realistic choice is between two global exchanges rather than between an exchange and a bank.
• You trade often enough that 0.10% against 0.60% is a number you feel.
• You are willing to keep the long-term holdings somewhere else and treat this as the operating account.

It does not fit if:

• You want a supervised venue above all else. Coinbase costs more and is more comprehensively regulated, and that trade is a legitimate one to make.
• You would keep your whole position on it. Nothing here is insured, the reserve attestation is a snapshot, and the entity you are trusting is a private company that publishes no accounts.
• You are in the United States, Canada, Singapore, Hong Kong, mainland China or Japan, where it does not operate. The United Kingdom is the one that moved recently: spot and peer-to-peer trading came back in December 2025, derivatives did not.
• Your spending is mostly domestic in a currency other than the dollar — the 2% foreign exchange fee will quietly outweigh the cashback.
• You know you will be tempted. The leverage is two taps away and the app never stops offering it.

The referral bonus, honestly

The link in this article is a referral link, so here is exactly what it does, including the parts it does not do.

The standard programme pays a new account for completing tasks: 10 USDT for depositing at least $100 within 7 days, 15 USDT for trading at least $500 within 30 days, a Mystery Box worth up to 1,000 USDT for trading $10,000 — where the box is a random draw and up to is doing all the work in that sentence — and 10 USDT for ordering the card and spending 100 USDT on it. Bybit advertises up to 1,720 USDT, but that headline is the referrer’s maximum and includes a 665 USDT copy-trading tier the new account never sees; the ceiling on the new account’s side is 1,045 USDT, almost all of it a lottery ticket. The realistic figure for somebody who deposits a few hundred dollars and buys some bitcoin is 10 to 25 USDT, and I would rather you knew that before clicking than after.

The conditions matter more than the amount:

• The bonuses cannot be withdrawn. They are usable as margin for derivatives and to cover trading fees and losses; only profit you make with them can leave the exchange. A bonus that can only be spent on leveraged trading is a marketing instrument aimed at turning a cautious new user into a trader, and it should be read that way.
• The code goes in at registration or not at all. There is no way to attach it afterwards. If you have an account already, this link does nothing for either of us.
• It excludes the way this site’s readers actually behave. If your plan is to buy and move the coins straight out, the programme is not for you: there is a 14-day holding check during which withdrawing funds disqualifies you, and volume from grid bots or zero-fee pairs does not count towards the trading tasks. Between them that rules out both the way readers here buy and the way they store. Know it before you click, not after. The monthly reward pool is capped at 500,000 USDT and allocated first come, first served on top of that.
• Residents of the European Economic Area cannot onboard to Bybit Global at all — Bybit EU runs its own referral programme on its own terms — and individual campaigns exclude individual countries besides; one recent Earn promotion excluded Georgia, of all places. What the link gets you depends on the campaign running and on your region, so check the terms page after signup rather than trusting this paragraph.
• What I get is a share of the trading fees paid by people who sign up through the link. Not a one-off bounty — a continuing cut, which is a stronger incentive to flatter an exchange than a single payment would be. That is why the list of things I dislike sits above this section rather than below it.

With all of that on the table, here is the link. If you use it, open the campaign terms page inside your account afterwards and check which of those tasks your region actually has — that page is the authority on what you are owed, not this article.

After five years

What I would say to someone asking over dinner: it is a good operating account and a bad vault. The fees are ordinary at 0.10% a side, and worse than ordinary if you buy through the fiat book without noticing. The card is the feature I would actually miss, and it is still a card whose 2% is capped at $5 a month and which charges me 2% on every lari transaction. The bots carry no subscription and no share of profit — you pay ordinary trading fees on every order, which for a frequently trading grid bot is the real cost and for the DCA bot is a genuinely good deal. Earn is a shelf I mostly walk past. And in February 2025 the worst thing that has ever happened to an exchange happened to this one, and the withdrawals kept clearing — which earned it my working balance and did not earn it my long-term holdings, because what stood between customers and that loss was a private company’s ability to absorb it, and that is not something anyone can verify in advance.

If that description fits what you are looking for, my referral link is here — whatever signup campaign is live in your region for you, a share of your trading fees for this site, and identical pricing either way. If the article has talked you out of it, that is a perfectly good outcome of an honest review, and I would rather have it than the referral. There is a companion piece on the account I use for the fiat side if that is the layer you are actually missing.

Frequently asked questions

Is Bybit safe?

It is a licensed exchange with a record that has been tested harder than most. Bybit holds a MiCA crypto-asset service provider licence from the Austrian regulator, a full UAE securities regulator licence, a Dubai VARA in-principle approval rather than an operating licence, a virtual asset service provider registration with the National Bank of Georgia and several others, and it publishes a monthly proof-of-reserves attestation with a Merkle tree.

In February 2025 it lost $1.46 billion to a North Korean group and paid every withdrawal anyway, absorbing the loss on its own balance sheet. There is also no United States enforcement action against it on record — no SEC case, no CFTC proceeding, no OFAC designation.

But safe has limits here that are worth stating plainly. No deposit insurance covers your balance, and the insurance fund of about $1 billion is scoped entirely to futures liquidations. The reserve attestation comes from Hacken, a security firm rather than a big-four auditor, and since July 2026 it has been described as a technical verification rather than an audit, with the report itself saying it is not a comprehensive review of assets, liabilities or overall financial position.

The regulatory file includes a €2.25 million Dutch fine, a Canadian settlement and exit, a Malaysian order to disable the site, an Indian penalty before registration, and a Japanese wind-down running through 2026. And the main day-to-day risk to an ordinary account is not theft but a compliance review that holds it while documents are checked. Treat it as an operating account, not a vault.

Is Bybit available in Georgia?

Yes. Georgia is not on Bybit’s restricted country list as of 5 August 2026, and Bybit has been registered as a virtual asset service provider with the National Bank of Georgia since November 2024. Georgia is also its own line in the official card table, which means residents can get the Bybit card as a US dollar Mastercard — worth knowing because the card is not issued everywhere. The practical catch is the 2% foreign exchange fee on transactions that do not settle in dollars, which in Georgia means almost every local purchase. Note also that the country list is only one of three filters: sanctions lists of named individuals apply on top of it, and identity verification is decided case by case on your documents rather than on your country of residence.

Does the Bybit card work with Apple Pay?

No. Bybit’s own fees and limits page for the card lists Google Pay and Samsung Pay as supported and Apple Pay as not supported, as of 5 August 2026. If tapping an iPhone is how you intend to spend, this is the wrong card. Everything else about it works normally: a virtual card is free and issued immediately, a physical one costs 29.99 USDT once, there is no annual fee, and it funds itself by selling BTC, ETH, XRP, USDT, USDC or GRAM in a priority order you set, at the One-Click Sell rate plus 0.9%. The $1 in the fee table is a minimum conversion amount rather than a minimum charge, so a $4 purchase costs about four cents to convert.

What did the 2025 hack cost users?

Nothing directly. On 21 February 2025 attackers took $1.46 billion out of one Bybit cold wallet by compromising the interface of Safe{Wallet}, the third-party multisig service Bybit used, so that its signers approved a transaction different from the one shown on screen; outside forensic reviews by Sygnia and Verichains traced the root cause to that JavaScript, with Sygnia stating it found no evidence Bybit’s own systems were compromised, and the FBI attributed the theft to North Korea. Bybit did not pause withdrawals, says it processed 99.994% of more than 350,000 withdrawal requests within ten hours, raised $1.23 billion in bridge loans, whale deposits and over-the-counter purchases with a further 40,000 ETH lent by Bitget, and had reserves back to 1:1 within 72 hours, verified by Hacken on 24 February 2025. The loss was absorbed by the company. Most of the money never came back: by September 2025 roughly $73 million had been frozen, under $30 million recovered, and over $1 billion sat with parties that never responded — untraceable in practice, though the mixer trail Bybit publishes accounts for about $260 million of it.

Are the Bybit trading bots free?

There is no subscription and no share of profit on any of them — five types in the bot builder plus the separate TradFi Combo product — and Bybit’s help pages state that no other fees are charged to create a Spot Grid or DCA bot. You still pay the ordinary trading fees on every order the bot places, which at 0.10% a side adds up for a grid bot that trades frequently, so free means free of rent on the automation rather than free of cost. Two practical notes: the Spot Grid bot cannot be liquidated because it is unleveraged, while the Futures Grid and Futures Martingale bots can be; and the DCA bot routes idle funds into Flexible Easy Earn by default, with the checkbox for that offered only while you are creating the bot.

Can I withdraw Bybit referral bonuses?

No. Bonuses credited through the referral programme cannot be withdrawn. They can be used as margin for derivatives trading and to cover trading fees and losses, and only the profit you make using them can be withdrawn. Several other conditions are easy to miss: the referral code can only be entered when you register and never added afterwards, volume generated by grid bots and trades on zero-fee pairs does not count towards the trading tasks, there is a 14-day period during which withdrawing funds disqualifies you, the monthly reward pool is limited to 500,000 USDT on a first-come basis, residents of the European Economic Area cannot onboard to Bybit Global at all and get Bybit EU’s own referral programme on its own terms instead, and individual campaigns exclude individual countries.