Bybit in 2026: What European Users Actually Get from the Exchange That Lost $1.5 Billion

In February 2025, Bybit lost roughly $1.5 billion in a single afternoon. It was the largest cryptocurrency theft ever recorded, and by most historical precedent it should have ended the company. Mt. Gox lost less and collapsed. FTX lost less and collapsed.

Bybit restored withdrawals within about twelve hours, replaced the missing reserves within seventy-two, and finished 2025 as the second-largest exchange in the world by trading volume.

That survival is the headline most coverage stops at. The more useful story for anyone in Greece is what has happened since, because as of July 2026, a Greek resident cannot legally use the Bybit that most reviews describe. What they can use is a smaller, differently licensed platform operating out of Vienna, with a narrower product range than the global exchange and a regulatory permission set that is far more limited than the "MiCA-licensed" label suggests.

This review covers both.

The company

Bybit launched in March 2018. Ben Zhou is its co-founder and chief executive and remains in post. [1][2]

It is a private company. It has never published audited financial statements, has never disclosed revenue or profitability, and has no announced IPO. PitchBook's public profile leaves valuation and revenue blank. [3][4] This is worth stating plainly rather than glossing over: unlike Coinbase, which files with the US Securities and Exchange Commission, there is no independently verified financial picture of Bybit available to anyone outside the company.

The global operating entity is Bybit Fintech Limited, registered in the British Virgin Islands. The company moved its global headquarters from Singapore to Dubai in 2022, during the UAE's push to attract digital-asset firms, and operates there through Bybit Fintech FZE. In October 2025 it announced a regional operations centre in Abu Dhabi. [2][5][6]

Three companies in Vienna

For European users, none of the above is the counterparty. Bybit's EEA business runs through three separate Austrian entities, and understanding the split is the single most practical thing a Greek reader can take from this article.

[7][8][9]

Mazurka Zeng is managing director of Bybit EU. Georg Harer is managing director and head of legal and compliance, and also a managing director of Bybit Payments GmbH. [9][10][11]

The practical consequence: if you open a Bybit account in Athens today, your contract is with an Austrian company, your regulator is the Austrian Financial Market Authority, and your complaints go to Vienna, not to the Hellenic Capital Market Commission.

The licence, and what it does not cover

This is where most coverage of Bybit in Europe is simply wrong.

Austria's Financial Market Authority authorised Bybit EU GmbH as a crypto-asset service provider under Article 63 of Regulation (EU) 2023/1114 by decision dated 28 May 2025, published on 30 May. [7]

The authorisation covers exactly five of MiCA's ten services:

1. Custody and administration of crypto-assets on behalf of clients
2. Exchange of crypto-assets for funds
3. Exchange of crypto-assets for other crypto-assets
4. Placing of crypto-assets
5. Transfer services for crypto-assets on behalf of clients [7]

It does not cover operation of a trading platform for crypto-assets. Nor execution of orders, reception and transmission of orders, investment advice, or portfolio management. Bybit's own press-release boilerplate confirms this without ambiguity: Bybit EU GmbH is neither the operator of a crypto-asset trading platform nor a provider of investment advice. [7][8][9]

The distinction matters because European listicles routinely place Bybit alongside Kraken, Coinbase and OKX under a single "MiCA-licensed" heading. Those platforms hold trading-platform permission. Bybit EU does not. Of the roughly 210 firms authorised across the EU by late May 2026 (out of 1,100 to 1,300 that previously operated under national regimes), only around fourteen hold that particular permission. [12][13]

The licence passports across 29 EEA states, with Malta excluded from Bybit EU's service area at launch. Greece is inside the passport. [14][15][16]

Two further pieces complete the picture. Bybit Payments GmbH received an Electronic Money Institution licence from the Austrian FMA, announced 4 August 2026, opening the door to payment services delivered through the bybit.eu front end, with no launch dates yet announced. [8] And Bybit X GmbH applied in September 2025 for an investment-firm licence under Austria's WAG, the national implementation of MiFID II, which would permit futures and options for EEA clients. In August 2025 Zhou said he hoped to have EU derivatives live within six months. Eleven months on, no grant has been announced. [9][17]

Outside Europe, Bybit holds a full Virtual Asset Platform Operator licence from the UAE's Securities and Commodities Authority (October 2025), a VARA permission in Dubai, FIU-IND registration in India, an AFSA licence in Kazakhstan, and a VASP registration with the National Bank of Georgia. [18][19][20] It does not serve the United States. Its service agreement, updated 7 May 2026, lists fourteen excluded jurisdictions, with the US first; the UK, Canada, Singapore, mainland China and Hong Kong are also restricted. Bybit ceased serving UK users in March 2021 following the FCA's ban on retail crypto derivatives. [2][20][21]

What a Greek user actually gets

Since 1 July 2026, EEA residents cannot use the global bybit.com platform. MiCA's transitional period ended that day with no extension, and Bybit migrated European users to bybit.eu, which had gone live a year earlier on 1 July 2025. [14][15][22]

Here is what changed, and it is substantial.

No derivatives. bybit.eu offers spot trading and spot margin with up to 10x leverage. It offers no perpetuals, no futures and no options. The product Bybit is most famous for, the one that until recently made up around 88% of its trading volume, is not legally available to a Greek trader on the platform. [21][23][24]

No USDT. Tether has not sought MiCA authorisation, so no licensed EU venue can list USDT. Bybit EU supports Quantoz's MiCA-compliant USDQ and EURQ, plus euro balances. Holding USDT in your own wallet remains perfectly legal: MiCA binds the service provider, not the individual. [21][13][25]

SEPA works. Euro deposits and withdrawals are supported. [24][26]

Travel Rule on everything. Bybit EU applies Travel Rule verification to every crypto deposit and withdrawal with no minimum threshold. Under the EU Transfer of Funds Regulation it must also verify ownership of self-hosted wallets for transfers above €1,000, which any Greek user moving funds to a hardware wallet will encounter. [21]

Misrepresenting your residency is not a workaround. Using a VPN or false residence data to reach the global platform breaches the service agreement and can result in frozen withdrawals and liquidated positions. [21][14]

There is also a Bybit EU card, a Visa-linked debit product launched in September 2025 with Apple Pay and Google Pay support. Published fee figures date from October 2025 and should be checked against the current terms page before you rely on them. [24]

Greece is where Binance failed

The Greek regulatory picture became genuinely newsworthy in 2026, and Bybit is a direct beneficiary.

The Hellenic Capital Market Commission (Επιτροπή Κεφαλαιαγοράς) is Greece's MiCA supervisor for crypto-asset service providers. It set out its authorisation procedure by Decision 8/1059 of 30 July 2025, under Article 101(a) of Law 5193/2025, and granted Greece's first national CASP licences at its session of 22 July 2026, to XENIOS BLOCKCHAIN GROUP and CAPITAL WALLET GREECE. [27][28][29]

Bybit is not among them, and does not need to be: it serves Greece by passporting from Austria, with the FMA as its home supervisor.

Binance took the opposite route and lost. It filed its CASP application with the HCMC on 23 January 2026 and withdrew it on 24 June 2026, with Reuters reporting that the Commission intended to reject it. Reporting has pointed to MiCA's "fit and proper" requirements for owners and managers as the obstacle. Binance moved EU accounts to withdrawal-only from 1 July 2026. [30][31][32]

The world's largest exchange failed to obtain its European licence in Athens. Bybit is one of the venues absorbing the displaced users: it ran a "Move Your Funds, Get Rewarded" migration campaign through 31 July 2026, with welcome bonuses from €20 and card bonuses up to €120. [15]

For context on the market being fought over: roughly 200,000 Greeks hold cryptocurrency, about 1.87% of the population, ranking Greece 36th globally by penetration. [33]

21 February 2025

At the centre of any honest assessment of Bybit sits a single afternoon.

Approximately 401,000 ETH (some accounts put the figure as high as 500,000 including stETH and cmETH) worth roughly $1.4 to $1.5 billion, was drained from a single Ethereum multi-signature cold wallet. It remains the largest cryptocurrency theft on record. [2][34][35]

The attack was not a smart-contract flaw. Malicious code originating from compromised Safe{Wallet} developer infrastructure replaced a benign JavaScript file with a version specifically targeting Bybit's multisig cold wallet. During a routine cold-to-hot transfer, the signing interface was manipulated so that the transaction appeared legitimate to the person approving it. Forensic analysis was carried out by Sygnia Labs and Verichains. [2][35][36][37]

The FBI publicly attributed the theft to North Korea, naming "TraderTraitor" actors. Elliptic, Arkham Intelligence and TRM Labs independently linked it to the Lazarus Group. [2][38]

The response is the reason Bybit still exists. Zhou was notified at around 22:00 local time and responded within roughly thirty minutes. Withdrawals were restored within about twelve hours. Reserves were replenished within seventy-two hours by securing 447,000 ETH, with liquidity from Galaxy Digital, FalconX and Wintermute. No customer lost funds. [1][2]

Laundering was fast: over $160 million moved within 48 hours and more than $400 million within five days, through decentralised exchanges, cross-chain bridges, mixers and the anonymous swap service eXch, which Bybit publicly criticised for processing roughly $90 million despite requests to block. [35][39][40]

Bybit launched LazarusBounty, offering up to $140 million, structured as 5% to whoever traces funds and 5% to whoever freezes them. As of around September 2025: over $73 million frozen, just under $30 million recovered, $2.3 million paid out to thirteen bounty hunters, and more than $1 billion classified as "gone dark." Over 5,000 reports were submitted, of which 63 were judged valid. [36][41][42]

One detail deserves inclusion precisely because it is uncomfortable: Zhou acknowledged that Bybit's internal systems had flagged compatibility problems with Safe months before the breach, and that the necessary upgrades were not completed in time. [36]

Post-incident, Bybit moved signing into isolated environments, tightened code review, audited all third-party tools and added real-time transaction anomaly detection. The company describes "50+ security improvements", its own figure. [34][43]

The market registered the damage clearly. Bybit's spot market share fell to roughly 6% in March 2025 from about 10% in February, then recovered across the year. [44]

Proof of Reserves

Bybit has published monthly Proof of Reserves reports verified by Hacken since June 2024. [45]

The 36th report, released 9 June 2026 and reflecting balances as of 27 May 2026, showed mainstream asset value above $16.5 billion, with reserve ratios above 100% for USDT, USDC, BTC and ETH. A further snapshot dated 22 July 2026 also showed reserves above 100%. [46][47]

The method is a Merkle tree combined with cryptographic proof of wallet ownership, with reserves compared against liabilities and audited by Hacken. Bybit does not use zero-knowledge proofs. Binance pairs a Merkle tree with a zk-SNARK; OKX uses a zk-STARK with an open-source verifier. On construction alone, Bybit's approach is the weaker of the three, because it still requires trusting how the tree was assembled. [45][48][49]

The standard limitations apply and should not be glossed over. Proof of Reserves is a point-in-time snapshot. It does not audit undisclosed liabilities. It does not prove that assets are unencumbered. It says nothing about future solvency or creditor priority in an insolvency. And it carries no deposit insurance or compensation guarantee of any kind. [47][49]

Volume and users

Bybit is genuinely large, and the numbers are consistent across independent sources.

TokenInsight's Q2 2026 data puts Bybit at approximately $1.62 trillion in total volume, with market share rising from 9.55% to 9.81%: second in spot at 9.19%, third in derivatives at 10.05% behind Binance and OKX. Notably, derivatives fell from 88% to 75% of Bybit's own volume quarter-on-quarter, a meaningful rebalancing. [50][51]

CoinGecko's full-year 2025 figures put Bybit second by spot volume at $1.5 trillion, an 8.1% share. December 2025 alone recorded $90.0 billion, a 9.5% share, down 16.7% month-on-month. [44]

One independent analysis gives higher figures (10.0% spot share and roughly 12% of perpetuals in Q2 2026), reflecting different methodology and venue coverage. Both should be read as a range rather than a single number. [52]

On users, every available figure is self-reported and unaudited. Bybit stated 80 million registered users at the end of 2025, up from 50 million at the start of that year, having announced 70 million in May 2025. Zhou cited over 82 million across 181 countries in a February 2026 keynote. No active-user figure has ever been published, and registered accounts include dormant and duplicate sign-ups. [53][54][55]

Institutional asset inflows rose from $1.3 billion in Q3 2025 to $2.88 billion in Q4 2025; again, a company figure. [54]

Fees

Global platform, standard (non-VIP) tier:

[56][57][58]

VIP tier is determined by 30-day trading volume or total asset balance, whichever is higher, more flexible than Binance, which combines volume with BNB holdings. Top tiers reach 0% maker and taker rates near 0.03%. [56][59]

Bybit offers no native-token fee discount. Unlike Binance with BNB or OKX with OKB, there is no token to hold for cheaper trading. Whether that counts as a drawback or a simplification depends on your view of exchange tokens; either way, it means your fee rate is determined purely by your activity. [23]

Crypto deposits are free. Withdrawal fees vary by asset and network. [57]

The cost most retail traders overlook is funding. On perpetuals, funding settles every eight hours and is charged on the full leveraged position size, not on the margin posted. At high leverage this dwarfs the headline trading fee, and no discount programme touches it. [57]

Bybit EU publishes its own separate fee schedule: do not assume the global numbers apply on bybit.eu. [59]

Products

On the global platform: spot trading across 350+ assets; spot margin to 10x; USDT, USDC and inverse perpetuals across 450+ pairs; futures; USDC-settled options; leveraged tokens; OTC and RFQ; pre-market perpetuals; copy trading; trading bots; Earn and staking; Launchpad and Launchpool; an NFT marketplace; P2P; a Web3 wallet; the Bybit Card; and a V5 API supporting around 300 requests per second for institutional users. [5][23][60]

More recent additions show where the company is heading. Bybit TradFi offers 200+ traditional instruments (stock CFDs, forex, commodities and indices) with plans for 500 pairs; MetaTrader 5 support was dropped in favour of the in-house TraFi 5 platform. MyBank was targeted for a February 2026 launch as a retail banking layer. ByCustody reports over $5 billion in assets across 30+ institutions. IPO Express, launched June 2026, offers tokenised IPO access, starting with SpaceX. xStock assets are accepted as collateral across margin and lending products, and HYPE-margined options launched in August 2026. [17][54][61][62][63]

The direction is unmistakable: Bybit is trying to stop being an exchange and start being a financial platform.

The legal record

This is a company that has been fined on three continents for operating without the required registration, and has in each case paid, registered and continued. Read it as you like: a pattern of moving first and complying later, or a pattern of eventually complying everywhere it matters.

Credibility: a split verdict

The gap between how people rate the product and how they rate the service is stark.

[67][68][69]

Recurring complaints across Trustpilot and Reddit are consistent: account freezes lasting weeks after full KYC, compliance reviews with no stated reason or timeline, withdrawal holds, template support responses with no escalation path, and P2P disputes. Bybit does respond publicly to negative reviews requesting case IDs. Multiple users report escalating to UAE regulators (VARA and the SCA) and to Sanadak, the UAE financial ombudsman; that this route exists is itself useful information. [68][69][70][71]

Review platforms over-sample extreme experiences and cannot verify identity or case detail. The fair reading is that Trustpilot is useful for identifying categories of complaint, not for labelling an exchange safe or unsafe. [47]

Bybit's sponsorship history includes the Argentina national football team (from 2021), the esports organisations NAVI and Astralis, and Oracle Red Bull Racing in Formula 1 from 2022 through 2024, concluded by mutual agreement. [2]

How Bybit compares in Europe

[12][13][30][31]

The comparison that matters for a Greek trader is with OKX, which holds nine of ten MiCA services, added a MiFID II licence in March 2025 and launched regulated derivatives across the EEA in April 2026. On regulatory breadth in Europe, Bybit is currently behind.

The risks, stated plainly

1. No derivatives. The product Bybit is known for is unavailable to you legally. Misrepresenting residency risks frozen funds.
2. No USDT. Balances sit in euro, USDQ, EURQ or supported crypto. USDQ and EURQ are far smaller and less liquid than USDT.
3. Proof of Reserves is not deposit insurance. No EU deposit-guarantee scheme covers crypto held with a CASP. MiCA improves conduct and disclosure; it does not make you whole if a platform fails.
4. Support is the documented weak point. Account freezes during compliance review are the most common complaint, and they happen to fully verified users.
5. Custody concentration is real. February 2025 proved a single compromised signing flow can move $1.4 billion. Bybit covered it. Not every exchange could.
6. Your regulator is in Vienna, not Athens.
7. Tax obligations are yours. Verify what the platform actually exports before relying on it.

What we could not verify

In the interests of not filling gaps with guesswork, the following could not be confirmed from public sources and are deliberately absent above: Bybit's revenue, profitability and valuation (never disclosed); its ownership structure; its employee headcount; active users as opposed to registered accounts; the size of its insurance fund and the specifics of its auto-deleveraging policy; whether bybit.eu offers a Greek-language interface; whether it produces tax exports usable for Greek filings; and whether the Bybit X MiFID II application has progressed since September 2025.

We also found no Hellenic Capital Market Commission or Bank of Greece notice concerning Bybit, but absence of evidence in a general search is not confirmation that none exists.

Frequently asked questions

Is Bybit legal in Greece? Yes. Greek residents are served by Bybit EU GmbH under a MiCA authorisation passported from Austria. Since 1 July 2026 the global bybit.com platform is closed to EEA residents.

Can I trade futures on Bybit from Greece? No. bybit.eu offers spot and spot margin up to 10x only. A MiFID II application that would permit derivatives was filed in September 2025 and has not been granted.

Why can't I find USDT? Tether has not obtained MiCA authorisation, so no licensed EU platform can offer USDT. Bybit EU supports USDQ and EURQ instead. You may still hold USDT in a self-custody wallet.

Is my money safe after the 2025 hack? No customer lost funds in that incident, and Bybit publishes monthly reserve reports showing over 100% coverage. But no crypto platform carries deposit insurance, and reserve reports are snapshots, not guarantees. Do not keep more on any exchange than you can afford to lose.

Who do I complain to if something goes wrong? Your supervisor is the Austrian Financial Market Authority, since Bybit EU GmbH is authorised in Austria. The Hellenic Capital Market Commission is not your first port of call.

Sources

All accessed 17 August 2026. P = primary, S = secondary.

1. P: Bybit, "Bybit 2025 Recap," PR Newswire, 3 Jan 2026 (self-reported)
2. S: Wikipedia, "Bybit", en.wikipedia.org/wiki/Bybit
3. S: PitchBook, Bybit company profile
4. S: IPOs.fyi, "Is Bybit Going Public?"
5. S: CoinMarketCap, Bybit exchange profile
6. S: CoinDesk, "Bybit Snags UAE's Virtual Asset Platform Operator License," 9 Oct 2025
7. P: FMA Austria, "Granting of Authorisation Bybit EU GmbH," 30 May 2025, fma.gv.at
8. P: Bybit.eu, "Bybit Payments GmbH Secures Electronic Money Institution Licence," PR Newswire, 4 Aug 2026
9. P: Bybit EU Group, "Sets Sights on MiFID II License," PR Newswire, 5 Sept 2025
10. S: BeInCrypto, "Bybit's European Expansion," 31 Jul 2025
11. S: EQS News, Bybit corporate news index
12. S: Yahoo Finance, "EU Crypto Deadline Looms: Only 14 Exchanges Are Licensed," 8 Jun 2026
13. S: EU Personal Finance, "MiCA-licensed crypto exchanges: the full list (2026)"
14. P: Bybit Learn, "Bybit EU and MiCAR," 9 Jun 2025 (self-reported)
15. S: Bitcoin Foundation, "Bybit to Leave EU as MiCA Takes Effect," 29 Jun 2026
16. S: CASP Tracker, "Does Bybit have a MiCA (CASP) license?", ESMA register synced 15 Aug 2026
17. S: Finance Magnates, "Bybit Pursues MiFID License for EU Derivatives," 6 Aug 2025
18. S: CoinDesk, UAE SCA licence, 9 Oct 2025
19. P: Press Information Bureau, Government of India, FIU-IND penalty release
20. S: Datawallet, "Bybit Supported and Restricted Countries in 2026"
21. S: LeoDex, "Bybit EU Migration: What EEA Users Must Do Before July 1, 2026," 10 Jun 2026
22. S: crypto.news, "Bybit limits EEA access as MiCA deadline closes in," 30 Jun 2026
23. S: CryptoSlate, "Bybit Exchange Review (2026)," Jul 2026
24. S: Gate News, "Bybit EU Review," 17 Oct 2025
25. S: Coin Wallet, "MiCA Regulation Explained: What Bybit's EU License Means"
26. S: Datawallet, "Best MiCA Licensed Crypto Exchanges," 25 Jun 2026
27. S: EY Greece, "Κανονισμός MiCA, Διαδικασία Αδειοδότησης," 25 Sept 2025
28. S: Nomiki Bibliothiki Daily, same subject, 25 Sept 2025
29. S: MoneyMatters, "Ελλάδα: Οι πρώτες άδειες crypto βάσει MiCA," Aug 2026
30. S: BusinessNews.gr citing Reuters, 16 Jun 2026
31. S: Startupper.gr, "MiCA: Το μεγάλο ξεκαθάρισμα," Aug 2026
32. S: Paybis, "MiCA-Licensed Crypto Exchanges 2026," Jul 2026
33. S: Mononews, "Νέα εποχή για την ελληνική αγορά crypto," 2 Aug 2026
34. S: Traders Union, "Bybit Hack: Full Timeline," 23 Dec 2025
35. S: Forbes, "Inside The Bybit Hacking Incident," 1 Apr 2025
36. S: FinTech Weekly, "Bybit's $1.4 Billion Hack," 20 Mar 2025
37. P/S: Hacken, "Bybit Hack Investigation"
38. P: FBI IC3 Public Service Announcement, "North Korea Responsible for $1.5 Billion Bybit Hack," 26 Feb 2025, ic3.gov/PSA/2025/PSA250226
39. P: TRM Labs, "The Bybit Hack: Following North Korea's Largest Exploit," 27 Feb 2025
40. S: CSIS, "The ByBit Heist and the Future of U.S. Crypto Regulation," 28 Mar 2025
41. S: AGBI, "Crypto bounty hunters helped salvage Bybit's business," 18 Sept 2025
42. S: TechCrunch, "Hacked crypto exchange Bybit offers $140M bounty," 26 Feb 2025
43. S: Get Daily Toolbox, "Bybit Review 2026," 15 Mar 2026
44. P: CoinGecko Research, "Market Share of Centralized Crypto Exchanges," 2 May 2026
45. P: Hacken, "Assets Verified: Hacken's Ongoing Proof of Reserves for Bybit"
46. P: Bybit, "Latest Proof-of-Reserves Shows More Than $16.5 Billion," PR Newswire, 9 Jun 2026
47. S: Coin Bureau, "Bybit Review 2026," Aug 2026
48. S: Orochi Network, "Crypto Exchanges With Proof of Reserves," 14 Jul 2026
49. S: Spark, "Bitcoin Exchange Proof of Reserves: Verification Methods Compared," 23 Jun 2026
50. P: TokenInsight, "Crypto Exchange Report Q2 2026," Jul 2026
51. S: Landbase, "10 Fastest Growing Crypto Exchange Companies," Aug 2026
52. S: Spoted Crypto, "Largest Crypto Exchanges 2026," Jul 2026
53. S: DailyCoin, "Bybit Reaches 80M Users in 2025," 5 Jan 2026
54. P: Chainwire, "Bybit 2025 Recap," 2 Jan 2026 (self-reported)
55. P: Bybit, "Surpasses 70 Million Users," PR Newswire, 9 May 2025
56. P: Bybit Help Center, "Trading Fee Structure"
57. P: Bybit, "Trading Fees" announcement page
58. S: BitDegree, "Bybit Fees 2026," Aug 2026
59. S: Trade Reclaim, "Bybit Fees 2026," verified Jul 2026
60. S: kkdemian, "Liquidity Deep Dive: Bybit," 26 Feb 2026
61. P: Bybit, "2026 Vision as The New Financial Platform," PR Newswire, 29 Jan 2026
62. P: EQS News, Bybit corporate news index (IPO Express, 7 Jun 2026)
63. P: Bybit, "HYPE-Margined Options," PR Newswire, 5 Aug 2026
64. S: Bloomberg Law, "FTX Settles Suit Against Crypto Firm Bybit for $228 Million," 25 Oct 2024
65. P: De Nederlandsche Bank, "Fine for Bybit Fintech Limited," 22 Oct 2024, dnb.nl
66. S: CoinDesk, "Bybit Receives India Clearance After Settling $1M Fine," 6 Feb 2025
67. S: Datawallet, "Bybit Review 2026," 29 Jan 2026
68. P: Trustpilot, bybit.com reviews
69. P: Trustpilot, bybit.eu reviews
70. P: Trustpilot, bybit.com reviews, page 3
71. P: Trustpilot, bybit.com reviews, page 4