Rating report

Bybit

Name: Bybit Review
Rating: 3.3

Grade B-, 3.3 out of 5

Bybit publishes monthly Merkle-tree proof of reserves audited by Hacken OU and holds a partial EU MiCA licence in Austria; it stayed solvent after the February 2025 theft of roughly $1.46–1.5bn — the largest exchange hack on record — replenishing reserves in full within 72 hours.

By Safety Desk. Facts checked against official sources on October 20, 2026.

Findings, check by check

Every KripZen grade comes from the same five weighted checks. Here is how Bybit scores on each.

Proof of reserves 30%
Merkle-tree and proof-of-liabilities audits by Hacken OU, monthly since June 2024 and published as signed reports; Hacken is a crypto-security specialist rather than a Big Four financial auditor.
What “Proof of reserves” means
Disclosed
Custody 25%
Cold/hot storage split is not disclosed; we could not confirm it from a primary source.
What “Custody” means
Partial or unaudited
Regulation 20%
EU MiCA licence via Bybit EU GmbH (Austrian FMA, May 2025) covering 5 of the 10 MiCA service categories, plus provisional, non-operational VARA approval in Dubai; the UK FCA issued a public warning in February 2025 and Bybit re-entered the UK in December 2025 through FCA-regulated Archax.
What “Regulation” means
Partial or unaudited
Insurance 15%
Maintains a dedicated insurance fund backstopping derivatives liquidations, which was drawn on in the post-hack solvency response, but its standing balance is not disclosed.
Partial or unaudited
Incident history 10%
About $1.46–1.5bn stolen in February 2025 through a Safe multisig interface phishing attack attributed to North Korea's Lazarus Group — the largest crypto exchange hack on record. Bybit remained solvent and fully replenished reserves within 72 hours, but only 3.54% of the stolen funds were ever frozen.
Not disclosed

The weights are the same for every exchange. Read the full methodology

Licences and registrations

The 3 entries we could confirm for Bybit on a regulator’s register or the exchange’s own legal pages. A licence in one country does not mean the service is open to you.

Regulator	Licence or registration	Register number
Austrian Financial Market Authority (FMA)Austria	MiCA CASP Bybit EU GmbH	LEI 5299005V5GBSN2A4C303; authorised 28/05/2025
Astana Financial Services Authority (AIFC)Kazakhstan	full licence (Bybit Kazakhstan) Bybit Kazakhstan	Not published
National Bank of GeorgiaGeorgia	VASP Bybit (entity name not confirmed)	Not published

Fees, products and reach

Spot fees (base tier): 0.1% maker, 0.1% takerNon-VIP, all spot pairs (varies by VIP level and region)
Proof of reserves: PublishedLatest report seen: 2026-09-23
Products: Spot, Futures, Staking, P2P
Founded: 2018
Not offered under its own terms in: United States, China, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Sudan, Syria

Base-tier fees from the exchange’s own fee page. Your real cost depends on order type, volume tier and spread; try your numbers in the Exchange Fee Calculator

Our Bybit review

Bybit is the venue that lost more money to a single attack than any exchange in history and still paid everybody back. Both halves of that sentence are in the B-.

What checks out

Merkle-tree and proof-of-liabilities audits have run monthly since June 2024 and are published as signed reports by Hacken OU. Hacken is a crypto-security specialist rather than a Big Four financial auditor, which is worth knowing when you read the signature — but a signature from outside the company is still more than most of this corpus offers. On the regulatory side, Bybit EU GmbH holds an EU MiCA licence from the Austrian FMA, granted in May 2025 and covering 5 of the 10 MiCA service categories.

Where the evidence stops

In February 2025 roughly $1.46–1.5bn was taken through a phishing attack on a Safe multisig interface, attributed to North Korea's Lazarus Group — the largest crypto exchange hack on record. Bybit remained solvent and fully replenished reserves within 72 hours, and only 3.54% of the stolen funds were ever frozen. The insurance fund that backstops derivatives liquidations was drawn on in that response, but its standing balance is not disclosed, so its capacity to absorb a second event is unknown. The cold/hot storage split is also undisclosed. The Dubai VARA approval is provisional and non-operational, not a live licence; the UK FCA issued a public warning in February 2025, and Bybit re-entered the UK in December 2025 through FCA-regulated Archax rather than on its own permission.

How to read the grade

Solvency through the worst attack the sector has seen is real evidence about a balance sheet, and it is not evidence that the attack surface has changed. The B- credits the recovery and refuses to treat it as a security record.

Incidents on record

2025
Bybit
Hack, February 2025. ~$1.46B in ETH and staked ETH (publicly reported estimate)
On 21 February 2025 attackers moved roughly $1.46 billion of ether and staked ether out of a Bybit cold wallet by manipulating what signers saw in a Safe multisig interface, so legitimate keyholders approved a transfer that was not what it appeared to be. The FBI attributed the attack to North Korea's Lazarus Group.
The lesson: No key was stolen — the approval screen lied. Cold storage and multisig only help when every signer can verify, independently of that screen, what they are actually authorising.

Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.

Sources

Every fact on this page comes from one of these official pages, checked on October 20, 2026.

Where to go next

Other exchanges we've graded

How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review. Cryptocurrency investments carry risk, including loss of principal. Nothing on KripZen is financial advice — always do your own research before buying, trading or moving funds.