01Bybit review at a glance
Most people who look up Bybit arrive for its derivatives, copy trading and promotions. The product is genuinely polished, but two things come first in any honest Bybit review: in 2025 it suffered the largest exchange hack in history, and the number of Asian countries where it can legally serve you is getting smaller.
Bybit at a glance
- Headquarters
- Dubai (moved from Singapore in 2023)
- Spot fees
- about 0.10% / 0.10% base tier
- Card purchases
- about 2%–3%, third-party fees extra
- Asian licences
- UAE SCA/CMA · Kazakhstan AFSA · India FIU-IND registration
- Closed / blocked
- Japan (no new users) · Hong Kong · Thailand · Philippines · Malaysia
- Europe
- MiCA licence via Austria (May 2025)
- Security incident
- ~$1.4–1.5B stolen Feb 2025; covered in 72 hours
- App rating
- Google Play India 4.5 (10M+ installs)
Bybit's strengths are its derivatives toolkit, low spot fees, a mature app and an active P2P market. Its weaknesses cluster around Asian compliance: no licence in Singapore, Hong Kong, Japan, Thailand or Malaysia, and several of those countries have explicitly shut it out. That is why it scores 8.1 — high marks for product, lower marks for where you can actually use it.
02The February 2025 Bybit hack and how Bybit responded
On 21 February 2025, about 400,000 ETH — roughly $1.4–1.5 billion at the time — was drained from one of Bybit's Ethereum multisig wallets. It is the largest exchange theft on record. The FBI attributed the attack to North Korea's Lazarus group (also tracked as TraderTraitor). The attackers did not break Bybit's own systems directly; they compromised the infrastructure of Safe{Wallet}, the multisig service Bybit used, and investigators found the signers had approved a manipulated transaction without realising it. It was a textbook supply-chain attack.
The response is the part worth remembering. Within 72 hours Bybit had plugged the gap using bridge loans and other funding, keeping customer assets backed one-for-one. Compare that with Japan's DMM Bitcoin, which closed after its 2024 hack, or India's WazirX, which socialised losses among users the same year: Bybit's balance sheet made the difference. The lesson cuts both ways, though — even a large exchange can lose a fortune because a third-party tool is compromised. More case studies in our exchange safety guide.
03Bybit licences and blocks across Asia
| Market | Bybit status | Regulator | What it means for you |
|---|---|---|---|
| UAE | First federal virtual-asset platform operator licence from the SCA (now CMA), Oct 2025, after in-principle approval in Feb 2025; not on Dubai's VARA public register | SCA / CMA | Home base; AED deposits available |
| Kazakhstan | Bybit Kazakhstan, AFSA-A-LA-2024-0027 (since Sep 2024) | AFSA (AIFC) | Local cards, Apple Pay / Google Pay; reported as the first regulated P2P venue there |
| India | Fined Rs 9.27 crore by FIU-IND on 31 Jan 2025; registered Feb 2025; full service back around Sep 2025 | FIU-IND | Registered and available. India guide |
| Japan | Unregistered; FSA warnings Mar 2023 and Nov 2024; no new sign-ups since 31 Oct 2025; existing residents restricted from Jan 2026 | JFSA | App removed from the Japanese store. Japan guide |
| Hong Kong | Put on the SFC suspicious-platform alert list 14 Mar 2024; first application withdrawn 31 May 2024; re-applied Jun 2025 (not deemed licensed) | SFC | Hong Kong is an excluded jurisdiction; P2P unavailable. Hong Kong guide |
| Thailand | Blocked from 28 Jun 2025, with charges filed with the Economic Crime Suppression Division | Thai SEC | Residents should use SEC-licensed platforms. Thailand guide |
| Philippines | Named unregistered by the SEC in Aug 2025; removed from Google Play and blocked by PLDT and Smart on 18 Mar 2026 | SEC / NTC | Existing users can still withdraw |
| Malaysia | On the Investor Alert List since Jul 2021; ordered on 11 Dec 2024 to disable its site and apps within 14 business days; compliance confirmed 27 Dec 2024 | SC | Malaysia guide |
| Singapore | Unlicensed; moved HQ out in 2023 | MAS | Does not serve Singapore retail users |
| Taiwan | Not registered with the FSC; reportedly singled out over local advertising | FSC | No Taiwanese legal protection |
| South Korea | Unregistered; on Upbit's transfer whitelist | KoFIU | Serving Koreans without registration is legally risky |
| Indonesia | Not on the OJK whitelist | OJK | Illegal to offer services in OJK's view |
| Mainland China | Excluded by the terms | PBoC | China rules |
In one line: in the UAE, Kazakhstan and India, Bybit has a licence or registration you can check; in Japan, Hong Kong, Thailand, the Philippines and Malaysia it has left or been blocked. We do not offer ways around regional restrictions — and misstating your country of residence at sign-up is the quickest way to a frozen account and stranded funds.
04Bybit fees
Bybit's base-tier spot fees are about 0.10% maker and 0.10% taker, in line with Binance, and fall as your VIP level rises. Card purchases cost roughly 2%–3%, plus a third-party provider's fee where one is involved. P2P takers pay nothing, but check the merchant's premium. Derivatives have their own fee table, and leverage magnifies losses; we don't recommend them to beginners, for reasons explained in spot vs futures.
One detail people miss: Bybit keeps a list of restricted card-issuing countries for its fiat services — cards issued in Kyrgyzstan, for example, may fail. Checking before you pay saves a declined transaction. The broader picture is in our fee comparison.
05Bybit Card: can Asian users get one?
The Bybit Card is a Mastercard debit card that spends your crypto balance. As far as we can establish (we could not verify the country list on Bybit's site), it is issued mainly in the EEA, the UK, Australia and parts of Latin America, with only a few Asian markets reportedly eligible. Marketing has highlighted no issuance fee, an FX fee of about 0.9% and cashback.
For most Asian readers the honest answer is "don't count on it". Hong Kong is a Bybit-excluded jurisdiction, and users in Japan, Thailand, the Philippines and Malaysia cannot use the exchange at all. If you want a card that spends crypto, our crypto card comparison lists options you can actually apply for in Asia.
06Buying crypto on Bybit
- Check your country is served
Japan, Hong Kong, Thailand, the Philippines, Malaysia, Singapore and mainland China are out. Kazakhstan residents use Bybit Kazakhstan. Give your real country of residence.
- Register and complete KYC
Upload an ID and a selfie. Bybit ties withdrawal limits to KYC level.
- Fund the account
Card (Visa / Mastercard, Apple Pay, Google Pay), P2P, or local bank rails in the UAE and Kazakhstan.
- Buy on the spot market
Beginners can use one-click buy / convert. Watch that you do not land in the derivatives screen by mistake — Bybit puts futures front and centre.
- Secure the account
Authenticator 2FA, withdrawal whitelisting and an anti-phishing code; move larger sums to self-custody.
Don't need futures or leverage, just a small spot purchase by card? A dedicated card-purchase platform is another option.For supported countries · Visa / Mastercard / Apple Pay
Buy with card07Website and app UX
Bybit's interface is built for traders: quick order entry, smooth charts and every derivatives tool you could want. The flip side is noise. The home screen is crowded with campaigns, rewards and futures shortcuts, and it is easy for a newcomer to drift into high-risk products without meaning to.
Bybit websitebybit.com ↗
Fluid spot and derivatives screens with plenty of order types; too many promotions on the home page.
Bybit appbybit.com ↗
Fast order execution and clear entry points for copy trading and grid bots; futures are too prominent for beginners. Rated 4.5 on Google Play India.
08Who Bybit suits
Good fit: residents of the UAE, Kazakhstan or India, where Bybit is licensed or registered; experienced derivatives traders who understand leverage; users who want copy trading or grid bots (see our trading bots guide).
Poor fit: residents of Japan, Hong Kong, Singapore, Thailand, the Philippines, Malaysia or mainland China; first-time buyers who just want a little Bitcoin; and most Asian readers hoping to get a Bybit Card.
09Pros, cons and verdict
Pros
- Covered the 2025 shortfall within 72 hours; users bore no loss
- First UAE SCA/CMA platform licence, AFSA licence in Kazakhstan, FIU-IND registration in India
- Base spot fees about 0.10%; deep derivatives toolkit
- Publishes Merkle-tree proof of reserves
- Mature, fast app and an active P2P market
Cons
- The record hack exposed third-party tooling risk
- No new users in Japan; unavailable in Hong Kong, Thailand, the Philippines and Malaysia
- Fined Rs 9.27 crore in India; unregistered in Taiwan, Korea and Indonesia
- Home page and app push futures and promotions; easy for beginners to stray
- Bybit Card largely unavailable in Asia
Our verdict
Bybit is a well-built exchange that behaved responsibly in a crisis, but its legal footprint in Asia keeps narrowing. If you live in the UAE, Kazakhstan or India and understand derivatives risk, it is worth a look. If you just want your first Bitcoin, there are simpler and better-suited routes.
10Alternatives to Bybit
- Editor's pick for card purchases
CEX.IOfounded 2013 · card purchases
No futures clutter — a short card checkout with published fees, available in supported markets such as Hong Kong, Taiwan and Thailand. No Asian licence; does not serve Japan, Singapore or India.
- Card 0.49%–4.99% + service
- PCI DSS Level 1
-
Binancelargest by volume
Deepest liquidity; licensed local entities in Japan, Thailand, Indonesia, Kazakhstan and the UAE.
- Spot 0.10% / 0.10%
- Zero-fee P2P for takers
-
OKXexchange + Web3 wallet
Cleaner interface and a stronger wallet; licensed via OKJ, in Singapore and Dubai; unavailable in Hong Kong, Thailand and the Philippines.
- Spot about 0.08% / 0.10%
- Built-in Web3 wallet
See also our Kraken review (no customer-asset theft on record) and Crypto.com review (its Visa card is available in some Asian markets). More platforms in our exchange rankings.
FAQ
Is Bybit safe after the 2025 hack?
On 21 February 2025 Bybit lost about 400,000 ETH (roughly $1.4–1.5 billion), the largest exchange hack on record. The FBI attributed it to North Korea's Lazarus group (TraderTraitor), who got in through compromised Safe{Wallet} infrastructure. Bybit covered the shortfall within 72 hours using bridge loans and other funding, so customer assets stayed backed 1:1 and users did not bear the loss.
Can I still use Bybit in Japan?
Not as a new customer. Bybit is not registered with Japan's FSA, received FSA warnings in March 2023 and November 2024, stopped new Japanese sign-ups on 31 October 2025 and began restricting existing Japan-resident accounts from January 2026. The app is no longer in the Japanese App Store. Japanese residents should use an FSA-registered exchange.
Where is Bybit licensed in Asia?
As of October 2026, Bybit holds the UAE's first federal virtual-asset platform operator licence from the SCA (now CMA), granted in October 2025; Bybit Kazakhstan holds AFSA licence AFSA-A-LA-2024-0027; and Bybit registered with FIU-IND in India in February 2025. It is unavailable or blocked in Hong Kong, Thailand, the Philippines, Malaysia and Japan.
Can I get a Bybit Card in Asia?
Mostly not. As far as we can establish, the Bybit Card is a Mastercard debit card issued mainly in the EEA, the UK, Australia and parts of Latin America, with only a few Asian markets reportedly eligible and conditions that change often. Hong Kong is an excluded jurisdiction for Bybit. Check the countries listed on Bybit's official card page before applying.
What are Bybit fees?
Bybit's base-tier spot fees are about 0.10% maker and 0.10% taker, similar to Binance, and fall with VIP level. Card purchases usually cost around 2%–3%, plus the provider's fee if a third party processes them. P2P takers pay no fee; the cost sits in the merchant's price premium. Derivatives have separate fees and far higher risk.
Sources
- Japan FSA — warnings to unregistered operators (incl. Bybit) · checked Oct 2026
- Hong Kong SFC press release 24PR47 — suspicious VATP alert list · checked Oct 2026
- FIU-IND — compliance orders (Order 15/2024) · checked Oct 2026
- Securities Commission Malaysia — Investor Alert List · checked Oct 2026
- Astana Financial Services Authority (AFSA) · checked Oct 2026
- Thai SEC — digital asset business licence check · checked Oct 2026
- Bybit — restricted card-issuing countries for fiat services · checked Oct 2026
No futures, just a spot purchase?
In supported countries you can buy Bitcoin, Ether or USDT directly with Visa, Mastercard or Apple Pay. Check first that the platform serves where you live.
International licensed platform · operating since 2013 · Visa / Mastercard / Apple Pay