Bybit suffered the largest exchange hack in history in February 2025 — approximately $1.5 billion in ETH stolen by North Korea's Lazarus Group via a compromised Safe{Wallet} interface. Bybit covered all losses from its own reserves without pausing withdrawals, and has since overhauled its cold wallet signing process. It remains a viable platform for experienced traders, but it holds no FCA authorisation and carries meaningful regulatory and custodial risk for UK retail users.
What Happened: The February 2025 Hack
On 21 February 2025, Bybit's cold wallet infrastructure was compromised in an attack attributed to the Lazarus Group, a North Korean state-sponsored threat actor. The attack vector was not a direct breach of Bybit's own systems — it exploited a compromised Safe{Wallet} front-end (a popular multi-signature wallet interface), which was manipulated to display a legitimate transaction while the underlying smart contract call redirected approximately 401,000 ETH to attacker-controlled addresses.
The theft totalled roughly $1.5 billion at prevailing prices, making it the single largest exchange hack in crypto history — surpassing the Ronin Bridge ($625M, 2022), Poly Network ($611M, 2021), and Binance BNB Chain ($570M, 2022). The attack was so sophisticated that Bybit's signatories approved what they believed to be a routine ETH cold-to-warm wallet transfer.
Blockchain analytics firms including Elliptic and Chainalysis attributed the attack to Lazarus Group within days, consistent with the group's known operational pattern: targeting exchange multi-sig infrastructure, laundering via mixing services, and bridging across chains. The FBI formally attributed the attack in March 2025.
Critically, Bybit did not pause withdrawals at any point. The exchange publicly stated it had covered the shortfall through emergency loans from partners and its own reserve base. An independent proof-of-reserves audit conducted shortly after confirmed customer assets remained fully backed on a 1:1 basis.
How Bybit Responded
Bybit's response was operationally credible in several respects. The exchange disclosed the breach publicly within hours rather than attempting to conceal it, published on-chain evidence of the attack, and engaged Chainalysis, Elliptic, and Arkham Intelligence to assist with tracing stolen funds. A bounty programme was launched offering 10% of recovered funds to ethical hackers and researchers who assisted.
On the financial side, Bybit secured emergency bridge loans — reportedly including a loan from Binance and Galaxy Digital — to restore reserves before the market opened. A post-incident proof-of-reserves attestation by Hacken confirmed 100% backing of customer assets within days of the hack.
The longer-term security response centred on eliminating the dependency on third-party signing interfaces. Bybit rebuilt its cold wallet signing process using an internal system with independent transaction verification, removing the UI layer that Lazarus Group had compromised. The exchange also brought in external security firms to conduct a full audit of its signing infrastructure.
What Bybit could not do was recover the stolen ETH. As of mid-2026, the Lazarus Group's laundering operation had dispersed the funds across mixers, bridges, and OTC channels — a pattern consistent with prior Lazarus operations (e.g., the Ronin Bridge hack proceeds remain partially unrecovered years later). The $1.5 billion loss was absorbed entirely by Bybit, not passed to customers.
Current Security Posture
Post-hack, Bybit's stated security architecture rests on three pillars: a rebuilt cold wallet signing process with independent transaction verification (no third-party UI layer), regular proof-of-reserves attestations by Hacken, and a segregated asset custody model that keeps customer assets separate from operational funds.
The Hacken proof-of-reserves methodology uses a Merkle tree approach — each customer can verify their account balance is included in the published tree root. Crucially, Hacken's attestations verify both assets and liabilities, not just the asset side. This addresses the primary weakness in post-FTX PoR programmes that only proved assets while leaving liabilities unverified.
Cold storage ratios are not published in real time, which is standard across the industry. Bybit has stated that the majority of customer assets are held in cold storage, replenished via multi-signature processes. Given the February 2025 attack targeted the cold-to-warm transfer process specifically, the rebuild of that signing mechanism is the most operationally significant security improvement.
It is worth stating plainly: no exchange can credibly claim to be immune to sophisticated nation-state attacks. The Lazarus Group's compromise of Safe{Wallet} was a supply chain attack — Bybit's own systems were not breached. The same attack vector could theoretically affect any exchange using third-party signing infrastructure. Bybit's response does not guarantee future immunity; it demonstrates operational resilience under extreme pressure.
- Rebuilt internal cold wallet signing system — no third-party UI dependency
- Hacken Merkle tree PoR covering both assets and liabilities
- Emergency reserve coverage confirmed — no customer losses from the February 2025 hack
- FBI and Chainalysis attribution confirmed: Lazarus Group (North Korea)
- Segregated customer asset custody confirmed post-incident
FCA Registration and UK Regulatory Status
Bybit is not FCA-authorised. This is the most important regulatory fact for UK readers. The Financial Conduct Authority requires all cryptoasset exchange providers operating in the UK to be registered on the FCA's Cryptoasset Register. As of mid-2026, Bybit does not appear on this register.
The practical consequence for UK users is significant. Bybit is not permitted to market or offer cryptoasset services to UK retail consumers without FCA registration. UK users who access Bybit via a VPN or by bypassing geo-restrictions do so without the protections that FCA registration is intended to provide — including access to the Financial Services Compensation Scheme (FSCS), which does not cover unregistered entities.
Additionally, the FCA banned the sale of crypto derivatives (including perpetual futures) to UK retail consumers in January 2021. Bybit's core product for many users is perpetual futures. Any UK retail user trading Bybit perps is accessing a product that would be prohibited if offered by an FCA-authorised firm. This is not a technicality — it is a substantive consumer protection gap.
Bybit does hold registration with VARA (Virtual Assets Regulatory Authority) in Dubai, where it is incorporated. VARA is a credible Tier 2 regulator — meaningfully better than no regulation, but not equivalent to FCA or MAS oversight in terms of consumer protection frameworks, capital requirements, or enforcement history. Verify Bybit's current VARA status directly at vara.ae before depositing.
Trading Products and Fees
Bybit built its reputation as a perpetuals exchange and that remains its strongest product. BTC/USDT perpetuals on Bybit have consistently ranked among the top three globally by open interest, alongside Binance and OKX. The platform offers up to 100x leverage on BTC perps, with linear (USDT-margined) contracts as the default format.
Spot trading fees sit at 0.10% taker and 0.08% maker at the base tier, with VIP tiers reducing fees based on 30-day trading volume or BIT token holdings. At high-volume tiers, maker fees can approach 0.01%. For UK readers: the FCA's retail crypto derivative ban means perpetuals are not a legally accessible product from FCA-authorised providers — Bybit operates outside that framework.
The copy trading and earn products are competitively structured, though yield products on any exchange carry the standard caveat: returns are not guaranteed, and counterparty risk applies to any funds deployed in earn programmes rather than held in self-custody.
Withdrawal fees are network-dependent and set by Bybit rather than the blockchain. USDT withdrawal via TRC-20 is typically under $1; ERC-20 is higher due to Ethereum gas. Always specify the network when withdrawing — a wrong-network transfer cannot be recovered.
- Spot maker/taker: 0.08% / 0.10% at base tier
- Perpetuals: up to 100x leverage on BTC — not available to UK retail under FCA rules
- USDT withdrawal via TRC-20 typically under $1
- VIP tiers reduce fees at higher 30-day volumes
- Copy trading and earn products available — counterparty risk applies to earn balances
Proof of Reserves: What the Attestations Actually Show
Bybit launched a proof-of-reserves programme post-FTX in late 2022, and the February 2025 hack triggered an emergency attestation that became one of the most scrutinised PoR exercises in exchange history. The post-hack Hacken attestation confirmed that customer assets were fully backed despite the $1.5 billion loss — Bybit's own capital and emergency loans had restored the balance before the attestation was conducted.
The Hacken methodology is credible: it uses a Merkle tree of hashed customer balances, publishes the root hash for independent verification, and includes liabilities alongside assets. Individual users can verify their balance is included using the leaf-node verification tool. This is materially better than self-attested PoR with no third-party auditor, and better than audits that only prove assets without matching liabilities.
The limitations are standard across the industry and should be stated clearly. PoR attestations are point-in-time snapshots — they confirm solvency at the moment of the audit, not continuously. An exchange that is solvent during the attestation and insolvent six months later will have passed its most recent PoR. Additionally, PoR does not verify that assets are unencumbered — funds pledged as collateral or lent out can appear in a PoR while simultaneously being at risk. Bybit has not published audited financial statements of the kind required of a listed company.
For practical purposes: Bybit's PoR programme is more credible than many exchanges and meaningfully more credible than FTX's total absence of one. It is not equivalent to the public company financial reporting that makes Coinbase (NASDAQ: COIN) uniquely transparent among major CEXs.
Who Bybit Is and Is Not Suitable For
Bybit is structurally suited to experienced derivatives traders who understand perpetual futures mechanics, funding rates, and liquidation risk — and who are outside jurisdictions with hard retail derivative bans (notably the UK and EU retail CFD restrictions).
The exchange is not suitable for UK retail users as a primary platform. The absence of FCA registration means no FSCS protection, no regulatory recourse through UK mechanisms, and access to products (perpetuals) that the FCA has explicitly banned for retail consumers. The February 2025 hack, while handled well, is a permanent data point in Bybit's risk profile.
For users in Dubai, Southeast Asia, and other regions where Bybit holds registration, the regulatory picture is meaningfully better. VARA registration in Dubai is a legitimate credential, and Bybit's post-hack transparency and reserve coverage demonstrated operational resilience at a scale most exchanges have never been tested at.
Anyone holding large balances on any centralised exchange — Bybit included — should consider that self-custody via a hardware wallet (Ledger or Trezor) removes custodial risk entirely for assets not actively traded. The rule of thumb: if you are not actively trading it, it should not be on an exchange.
- Suited to: Experienced derivatives traders in VARA/unregulated jurisdictions
- Not suited to: UK retail users — no FCA registration, perpetuals banned for retail
- Not suited to: Beginners — 100x leverage and liquidation mechanics require experience
- Consider self-custody: Hardware wallets (Ledger, Trezor) for holdings not being actively traded
- Always verify: Check Bybit's current VARA registration status at vara.ae before depositing
Bybit vs Alternatives for UK Users
UK retail users wanting regulated crypto access have a limited but credible set of options. Kraken holds FCA registration and offers spot trading with strong proof-of-reserves credentials — Armanino-audited since 2014, one of the longest-running credible PoR programmes in the industry. Coinbase is NASDAQ-listed (COIN), subject to SEC quarterly reporting, and holds FCA registration; its financial transparency is unmatched among major CEXs by virtue of being a public company.
Gemini holds FCA registration and operates under NYDFS oversight — the strictest US state-level crypto regulatory framework. Its SOC 2 Type II certification adds a further independent verification layer. Bitstamp, the oldest operating CEX (founded 2011), holds FCA registration and Luxembourg CSSF authorisation.
For derivatives exposure specifically, UK retail users face a genuine regulatory gap: FCA-authorised firms cannot offer crypto perpetuals to retail clients. Professional client classification (requiring net portfolio over £500,000 or relevant professional experience) is the only legal route to crypto derivatives through UK-regulated channels. This is not a quirk — it is the FCA's deliberate consumer protection policy.
The cost of regulatory compliance is real: Kraken and Coinbase have higher fees at base tiers than Bybit. For high-volume traders who understand the risk framework and operate in jurisdictions where Bybit is registered, the fee differential has a genuine argument. For UK retail users, regulatory protection should outweigh the fee saving.
Frequently asked questions
Did Bybit customers lose money in the February 2025 hack?
No. Bybit covered the entire ~$1.5 billion loss from its own reserves and emergency loans from partners. Customer withdrawals were never paused, and a post-incident proof-of-reserves attestation by Hacken confirmed 100% backing of customer assets. The loss was absorbed by Bybit's own capital, not distributed to customers.
Is Bybit regulated in the UK?
No. Bybit is not registered on the FCA's Cryptoasset Register and is not FCA-authorised. UK retail users accessing Bybit have no FSCS protection and no regulatory recourse through UK mechanisms. Bybit holds VARA registration in Dubai, where it is headquartered, but this does not extend to UK regulatory coverage.
Can UK users legally trade on Bybit?
Bybit's spot trading is technically accessible to UK users, but without FCA registration Bybit cannot lawfully market its services to UK retail consumers. More importantly, Bybit's core product — perpetual futures — was banned for UK retail clients by the FCA in January 2021. UK retail users trading Bybit perps are accessing a product class the regulator has explicitly prohibited.
How does Bybit's proof of reserves work?
Bybit uses a Merkle tree proof-of-reserves methodology audited by Hacken. Customer balances are hashed and included in a Merkle tree; the root hash is published and users can verify their individual balance is included via a leaf-node verification tool. Hacken verifies both assets and liabilities — not just assets — which addresses the most common PoR weakness. Attestations are point-in-time, not continuous.
Who carried out the February 2025 Bybit hack?
The attack was attributed to the Lazarus Group, a North Korean state-sponsored threat actor, by blockchain analytics firms Chainalysis, Elliptic, and Arkham Intelligence. The FBI formally attributed the hack to Lazarus Group in March 2025. The attack used a compromised Safe{Wallet} front-end interface to manipulate what Bybit's signatories saw on screen, while the underlying transaction redirected approximately 401,000 ETH to attacker-controlled addresses.
Is Bybit safe to use in 2026?
Bybit's post-hack response — covering losses without pausing withdrawals, publishing transparent attestations, and rebuilding its signing infrastructure — demonstrated meaningful operational resilience. However, 'safe' depends on your jurisdiction and use case. For UK retail users, the absence of FCA registration is a material risk factor. For experienced traders outside the UK in jurisdictions where Bybit holds registration, the risk profile is different. No centralised exchange is risk-free; assets not actively traded should be held in self-custody.
What are Bybit's trading fees?
Bybit's base tier spot fees are 0.08% maker and 0.10% taker. Perpetuals follow a similar structure. VIP tiers reduce fees based on 30-day trading volume, with maker fees approaching 0.01% at high-volume tiers. Withdrawal fees are network-dependent: USDT via TRC-20 is typically under $1, while ERC-20 withdrawals cost more due to Ethereum network fees.
How does Bybit compare to Kraken and Coinbase for UK users?
Both Kraken and Coinbase hold FCA registration and are the stronger choices for UK retail users. Coinbase's status as a NASDAQ-listed company (COIN) provides public company-level financial transparency that no PoR attestation can match. Kraken has one of the longest-running credible proof-of-reserves programmes in the industry. Both have higher base-tier fees than Bybit, but for UK retail users the regulatory protection is the primary consideration.
An independent publisher mapping the regulation of cryptocurrency exchanges. Our editorial desk verifies every licence and availability claim against primary sources — the ESMA MiCA register, the FCA register, ASIC, MAS, VARA and each exchange's own terms — and never accepts payment for a better assessment or placement. We publish information only; nothing here is financial advice.