On February 21, 2025, someone moved $1.5 billion in ether out of a Bybit cold wallet during what was supposed to be a routine transfer to a warm wallet. Chainalysis and Elliptic both trace the theft to North Korea's Lazarus Group. It remains the largest single crypto theft ever recorded, and it happened at an exchange that, at the time, ranked second in the world by trading volume. We opened an account, funded it, traded spot and perpetuals, and pulled money back out to see what that history actually costs a user today.

The hack, and what came after it

Bybit's own account, backed by a Hacken proof-of-reserves audit, is that the exchange pieced together enough ether through emergency loans and large deposits to restore full collateralization within roughly 72 hours. By February 24, 2025, reserves across major assets stood above 100%. No customer withdrawals were frozen and no user lost funds, according to the exchange and the reporting we checked.

That is a genuinely fast recovery for a nine-figure hole. It is also worth saying plainly: the breach happened because Bybit's internal transfer process had a gap the Lazarus Group could exploit, and the exchange is asking users to trust the same operational team that let it happen. Trust here is a bet on process improvements we cannot audit ourselves, not a guarantee.

We asked Bybit support directly what changed in the cold-to-warm transfer workflow since the incident. The reply pointed us to a public post-mortem and a bug bounty program rather than a specific technical fix we could verify ourselves, which is a fair answer for a security matter but not one that settles the question on its own. Chainalysis and other blockchain forensics firms have continued tracking the stolen ether as it moves through mixers, and recovery of the underlying funds themselves remains in the low double-digit percentages months later, separate from the reserve backfill that made customers whole.

What it costs to actually trade

Spot trading on Bybit runs 0.1% for both makers and takers at the base, non-VIP tier, in line with Binance and Kraken. Where Bybit pulls ahead is derivatives: perpetual futures charge 0.055% taker and 0.02% maker for non-VIP accounts, and those rates drop further at higher VIP levels, down toward 0% maker and roughly 0.03% taker. For a desk running size on USDT or USDC perpetuals, that spread over a competitor's 0.075% taker fee adds up fast across a month of trades.

The product menu extends past perpetuals into inverse contracts, USDC options, leveraged tokens and a spot marketplace, all inside one login. We did not need a second app for anything we tested, which is not true of every exchange on this list.

Withdrawals during our testing cleared to an external wallet in under ten minutes for USDT on the Tron network, with the network fee set by Bybit rather than passed through unmodified from the chain, so it is worth checking the quoted amount before confirming. A support ticket about a delayed deposit got a human reply within about four hours through live chat, which beat our experience with some competitors' first-line chatbots but still left us waiting for a real answer rather than getting one instantly.

Getting in, and who cannot

Account opening now requires full identity verification. Bybit dropped its no-KYC tier after regulatory pressure, so anyone hoping to trade anonymously with just an email address will be turned away. Once verified, funding and withdrawing worked as advertised in our testing, with standard network fees on crypto transfers.

Access itself is uneven by geography. The US and Canada remain off-limits entirely, with no path to a retail account for residents of either country. Elsewhere the picture has been improving: Bybit returned to the UK through the FCA-regulated firm Archax, came back to France after being removed from the AMF's blacklist, and re-registered in India with the FIU-IND in February 2025.

The mobile app, for what it is worth

Both the Android and iOS apps mirror the web platform's charting, order types and portfolio views closely enough that we moved between devices mid-session without missing a feature. Store listings on both platforms show a free download with in-app trading fees, matching what we paid on desktop.

Our verdict

Judge Bybit on fees and product range alone and it earns a strong score: cheap perpetuals, deep liquidity, and one account for everything from spot to options. Judge it on the trust question its own history now forces, and the answer is more mixed. The reserve recovery was fast and independently checked, but the hack still happened, and anyone in the US or Canada does not get to weigh either fact because the exchange simply will not take their account. We would trade there again for the fee savings on derivatives, and we would not park a life's savings on any single exchange, Bybit included, without spreading the risk.