Bybit Crypto Exchange Review - Security, Fees & 2025 Hack Impact

Looking for a straight‑forward take on Bybit? You’ve probably heard the name in headlines-either for its rapid growth or the massive 2025 hack that sent shockwaves through the crypto world. This review breaks down what Bybit actually offers, how its security stack works (and where it slipped), the fee structure for traders, and whether you should keep your assets on the platform or move them to self‑custody.

What Is Bybit?

Bybit is a global cryptocurrency exchange that provides spot, derivatives, and margin trading for a wide range of digital assets. Launched in 2018, the platform quickly gained a reputation for low latency, a clean UI, and aggressive marketing aimed at professional traders. By late 2024 the exchange boasted over 5 million registered users and daily trading volume surpassing $30billion.

Core Features and User Experience

• Web and mobile apps that support more than 120 trading pairs.
• Advanced charting tools powered by TradingView.
• Leverage up to 100× on futures contracts.
• Instant deposits and withdrawals for major fiat gateways in select regions.
• Customer support available 24/7 via live chat and ticketing.

The UI feels familiar if you’ve used other major exchanges-order books, depth charts, and a clear account overview sit front‑and‑center. Newcomers may need a few minutes to locate the “Earn” section where you can stake assets or provide liquidity, but the layout is intuitive enough to start trading within 10 minutes of signing up.

Security Architecture (Before the February 2025 Incident)

Bybit marketed itself as a security‑first exchange, employing a layered approach:

• Cold storage: Over 95% of user funds sat offline in air‑gapped wallets.
• Multi‑signature (multisig) technology that required multiple private keys to approve a withdrawal.
• Trusted Execution Environment (TEE) and Threshold Signature Schemes (TSS) for transaction signing.
• Two‑factor authentication (2FA), hardware key support (e.g., YubiKey), and encrypted data transmission.
• Real‑time monitoring of user behavior, with anomaly detection triggering additional verification steps.

These measures aligned with industry best practices and helped Bybit avoid many of the smaller phishing attacks that plagued newer platforms.

The February 21, 2025 Hack: How It Happened

On that fateful day, an advanced group linked to North Korea’s Lazarus Group exploited a series of supply‑chain vulnerabilities in Bybit’s internal tooling. Rather than breaking the cold‑wallet encryption, the attackers used social engineering to trick a privileged operator into approving a massive Ether transfer. Roughly $1.5billion worth of Ethereum (ETH) vanished from the exchange’s hot wallet, marking the largest crypto heist in history.

Key weaknesses identified by security firms included:

• Insufficient code‑signing verification for software updates.
• Lack of independent transaction approval-only one individual could authorize large withdrawals.
• Smart‑contract permissions that allowed the attacker to call privileged functions without an extra nonce check.

Even with robust multisig and cold‑wallet holdings, the breach showed that human factors and supply‑chain hygiene can override technical safeguards.

Bybit’s Response and Compensation Plan

Within hours, Bybit halted all ETH withdrawals, launched an emergency communication channel, and pledged to reimburse affected users from its own reserve fund. By the end of the week, the exchange had processed roughly 90% of withdrawal requests and announced a $43million bounty pool for researchers who could help trace the stolen funds.

Financially, Bybit’s ability to fund reimbursements signaled strong liquidity reserves, but the incident raised questions about long‑term trust and the role of custodial exchanges versus self‑custody solutions.

Post‑Hack Security Upgrades

Since the breach, Bybit has rolled out a set of hardening measures:

These updates align with recommendations from firms like Quant Network, which advocates enterprise‑grade key management and transaction signing solutions for on‑chain finance.

Fee Structure - What You’ll Actually Pay

Bybit’s fee model is competitive for high‑volume traders but can be confusing for casual users:

• Spot trading: Maker fees start at 0.01%, taker fees at 0.1% (both decrease with higher 30‑day volume).
• Futures contracts: Maker fees as low as -0.025% (rebate) for top tier, taker fees at 0.025% for the highest tier.
• Deposit fees: Free for most major coins; a small network fee may apply for ETH due to gas costs.
• Withdrawal fees: Fixed per coin (e.g., 0.005ETH per withdrawal) plus dynamic network surcharge.
• Staking/Earn: Annual yields range from 2% to 12% depending on the asset, but early‑withdrawal penalties apply.

If you trade under $10,000 per month, expect to pay roughly $15‑$30 per week in fees on a typical mixed‑spot/futures strategy.

Self‑Custody vs. Bybit Custody: Pros and Cons

After the hack, many users reconsidered whether to keep assets on an exchange. Here’s a quick rundown:

In short, Bybit offers convenience and a safety net (if you trust their compensation promise), while self‑custody eliminates the exchange‑level attack surface at the cost of personal responsibility.

Is Bybit Worth Using in 2025?

Answering that question boils down to three factors: security confidence, trading needs, and cost sensitivity.

• Security confidence: Bybit’s post‑hack upgrades and willingness to compensate losses boost its credibility, but the breach exposed a human‑error vector that any custodial service could face.
• Trading needs: If you need high‑leverage derivatives, deep liquidity, and API access for bots, Bybit still ranks among the top three exchanges globally.
• Cost sensitivity: Fees are transparent and competitive for high‑volume traders; casual users might find the tiered model a bit opaque.

Overall, for active traders who value speed and want to stay on a regulated platform, Bybit remains a solid choice-provided you enable every security option (2FA, hardware key, withdrawal whitelist) and consider moving large, long‑term holdings to a hardware wallet.