Is Bybit safe to connect?
Exchange ยท Multi-asset centralized exchange (derivatives, spot). Checked 2026-10-24; every line links its source.
Worst case: Bybit holds your coins: it can freeze your account if your funds are linked (even indirectly) to a listed counterparty, and an exchange-wide hack like Feb 2025 depends on Bybit's own reserves to make users whole.
Safe setup in 3 steps
- Bind every API key to your bot's static IP (unbound keys expire after 90 days anyway) and leave withdrawal permission off
- Keep the withdrawal address book limited to your own wallets, since API withdrawals can only go to saved addresses
- Avoid depositing coins that recently passed through sanctioned exchanges or mixers, as Bybit says such exposure can trigger a freeze
Bybit also has a full listing with an Agent Risk Score Agent risk 89% (partial, 6 of 7 inputs): Bybit on TradingAgentStack.
What it can do with your money
| Who holds the keys | The exchange holds your funds Custodial exchange; customer assets are held in Bybit-controlled wallets (the 2025 hack drained a Bybit cold wallet). source |
|---|---|
| Can funds be sent out to any address? | Yes. Withdrawals to external addresses; API withdrawals only by the master account's key and only to addresses already in the address book. source |
| Can it hold or freeze your funds? | News reports (Sep 2026) say Bybit published a 'Restricted Counterparty List' of 50+ platforms/entities (e.g. Garantex, Grinex, mixers, darknet markets, Lazarus Group); direct or indirect exposure can lead Bybit to freeze or terminate accounts, restrict balances and liquidate positions. Bybit's own Terms page could not be retrieved for this check. source |
| What a leaked API key can do | Bybit's API docs state API keys with no IP bound become invalid after 90 days, and keys without IP binding become invalid 7 days after the account password is changed. Withdrawal via API requires the master UID's key and the destination must already be in the address book ('whitelisted'). Whether new keys default to read-only, and whether withdrawal permission requires an IP binding, was not confirmed. source |
| Monero and Zcash | XMR: no spot market; XMR perpetual futures only (per third-party survey checked 2026-10-20) source |
Official links
- Website:
bybit.com
Where we confirmed these
Deadlines
- 2027-07-10: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service. source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2025-02-21 | Bybit hacked: ~400,000 ETH stolen from a multisig cold wallet via compromised Safe{Wallet} infrastructure; FBI attributed it to North Korea (TraderTraitor/Lazarus) | ~$1.4-1.5B | Bybit replenished reserves within ~72h via emergency funding; customers were not asked to absorb the loss | source |