Exchange record All ledgers
Bybit: its public record
Bybit’s public record: a MiCA authorisation, no New York licence, a Dubai licence, 1 hack ($1.40bn) and no US enforcement documents since 2024 naming it.
Bybit holds a MiCA authorisation in the EU through Austria, first granted on 28 May 2025. It isn’t on New York’s list of virtual currency licensees. In Dubai, the Virtual Assets Regulatory Authority lists Bybit Fintech FZE as licensed, from 20 October 2026. The hacks ledger records 1 hack of the company itself with a known loss, $1.40bn in all, on 21 February 2025. No US enforcement document in the ledger, which is complete from January 2024, lists it among the firms it mentions.
Licences
| Firm | Country | Regulator | From | Basis |
|---|---|---|---|---|
| Bybit EU GmbH trading as Bybit | Austria | Austrian Financial Market Authority (FMA) | 28 May 2025 | Authorised |
Dubai: Bybit Fintech FZE (Bybit), VASP Licence VL/26/10/003, from 20 Oct 2026 (Exchange Services). Source: VARA public register · every Dubai licence.
Hacks of the company itself
| Date | Target | Lost | Type | Method | Returned or repaid |
|---|---|---|---|---|---|
| 21 Feb 2025 | Bybit | $1.40bn | CEX | Signer Phishing | $1.40bn |
“Returned or repaid” can include money the exchange paid customers from its own funds, not only funds recovered from the attackers.
The theft of 21 February 2025 was attributed to North Korea by the FBI (North Korea Responsible for $1.5 Billion Bybit Hack).
From the hacks ledger, which follows DefiLlama’s records of incidents with a known loss. Hacks of a brand’s separate DeFi products, takeovers of its social media accounts and abnormal-trading incidents classed as market manipulation aren’t counted here.
US enforcement documents naming it
None in the ledger.
See every document in the company check.
On Bitminer.io
- What happened after the North Korea DeFi warning: Bybit, Tornado Cash, 71 addresses
- Q1 2025 in crypto hacks: Bybit’s $1.40 billion made up 86.8% of the quarter
What this record can’t tell you
This is the public record, not a safety rating or advice. It can’t show how a company holds customers’ money today, whether it is solvent, how it treats complaints, or cases outside the US. The enforcement ledger is complete from January 2024 and holds only some earlier documents. Matching is by name, so a firm with another name can be missed, and a record can lag the latest events. Every figure comes from the ledgers, each with its source: all 27 exchanges and apps compared.
Cite this Bitminer.io, “Bybit: its public record”, data to 6 November 2026, https://bitminer.io/ledger/exchange/bybit/. Free to reuse under CC BY 4.0 with credit and a link. How this is built · Frozen copy of November 2026’s data