Is Bybit safe? How to judge it properly

Updated 2026-08-28

"Is it safe" is really four questions wearing one coat: can the company lose my money, can somebody steal it from my account, can it be frozen, and can I lose it myself. They have completely different answers, and lumping them together is why most reviews of exchange safety are useless.

Question one: can the company lose your money

Any centralised exchange holds your assets on its own balance sheet. If it is hacked badly enough, or if it lends out reserves and the loan goes bad, your claim is against a company — not against a coin you control. This is the risk that no interface setting protects you from.

What reduces it in practice is evidence, not marketing. The useful evidence is a proof-of-reserves attestation performed by an independent auditor, published with its methodology and a date. A blog post announcing that reserves are "fully backed" is a claim, not evidence. When we cannot verify the current attestation and its methodology against a primary source, we say so rather than reassuring you — which is the case as this page stands.

The practical mitigation is unglamorous and works: do not store on an exchange more than you need for what you are actively doing. An exchange is a place to transact, not a vault.

Question two: can somebody steal it from your account

This is the risk you control most, and it is where most retail losses actually happen.

Two-factor authentication should be an authenticator app, not SMS. Phone numbers get taken over through the carrier, and once someone controls your number the SMS code protects nobody. Use a unique password that exists nowhere else, ideally from a password manager, because credential stuffing — trying leaked passwords from other sites — is the single most common attack and costs the attacker almost nothing.

Set a withdrawal address whitelist if the platform offers one and you withdraw to the same place regularly. It converts a total account compromise into a partial one.

Review active sessions and API keys periodically. An API key with withdrawal permission, created for a trading bot and forgotten, is a door left open behind you.

Question three: can it be frozen

Yes, and this surprises people. Exchanges are obliged to freeze accounts under legal orders, sanctions-screening hits, or their own risk rules — a deposit arriving from an address associated with illicit activity, for instance, can flag your account through no fault of yours.

You reduce it by completing verification properly and early with documents that match your actual residence, by not routing funds through mixers or opaque services, and by not attempting to access the platform from a country it does not serve. That last one is worth stating bluntly: circumventing a country restriction is a terms breach, and the usual outcome is a locked balance rather than a clever workaround.

Question four: can you lose it yourself

Overwhelmingly the most likely answer is yes, and in two specific ways.

The first is leverage. Leveraged positions can be liquidated in minutes, and liquidation can consume your margin entirely. No amount of platform security protects you from a position that goes against you. Read the risk disclosure before you touch derivatives.

The second is sending funds on the wrong network, or omitting a memo or tag when one is required. Recovery is sometimes possible and sometimes flatly impossible, and no support team can rewrite a blockchain. The deposit guide covers the specific checks.

The phishing layer sitting on top of all of it

None of the above matters if you type your credentials into a copy of the site. Attackers buy lookalike domains, clone the interface, and reach you through search adverts, messages and fake support accounts. Read the address character by character before you log in, and treat anyone who contacts you claiming to be support as hostile until proven otherwise. Nobody legitimate needs your password, your authenticator codes or remote access to your screen. The full method is on our official site and security page.

A short checklist worth doing once

Authenticator-app two-factor, unique password, withdrawal whitelist where possible, no API key with withdrawal rights unless you truly need it, verification completed with correct documents, only working balances kept on the platform, and the login address typed rather than clicked. That list is dull, it takes twenty minutes, and it prevents the overwhelming majority of real losses.

What "safe" honestly means here

Bybit is a large exchange with the security tooling you would expect and the structural risk that every custodial platform carries. Anyone who tells you an exchange is simply "safe" is selling something. The useful question is not whether it is safe but how much of your money belongs on it at any moment — and the answer to that is almost always less than people keep there.

Frequently asked questions

What actually protects my money on an exchange?
Nothing structural — your balance is a claim on a company. What reduces the risk is evidence, in the form of an independent proof-of-reserves attestation with a published methodology and date, plus keeping only working balances on the platform.
Should I use SMS for two-factor authentication?
No. Phone numbers get taken over through the carrier, and once someone receives your codes only the password remains. Use an authenticator app and store the backup codes offline.
Can an exchange freeze my account?
Yes. Legal orders, sanctions screening and internal risk rules can all trigger a freeze, sometimes because of where a deposit came from rather than anything you did. Completing verification properly and avoiding opaque funding routes reduces the chance.
What is the most common way people actually lose money here?
Leverage and wrong-network transfers, followed closely by phishing. Platform breaches make the news; these three make the losses.
How much should I keep on the platform?
Only what you are actively using. An exchange is a place to transact, not a vault — and that answer does not change based on which exchange it is.

Keep reading