Bybit Review: Fees, MT5 Integration and Security, Tested Hands-On

Bybit is one of the world's largest centralized crypto exchanges by trading volume. It was founded in 2018 and is headquartered in Dubai, and Bybit reports 80M+ users. It's one of the only major exchanges with MT5 integration (forex, commodities, indices) and holds an EU MiCA license (via Austria), ahead of Binance. It also survived the largest hack in crypto history: $1.46B was stolen in February 2025, and Bybit restored full user balances within 72 hours, with no user losses.

Before writing this review, we tested registration, fees, copy trading, security, and withdrawals end to end.

Our verdict: 8/10 — one of the strongest all-round exchanges, with regional exits deciding the score for readers in the US, France and Japan.

Fees, and what you'll actually pay

On spot trades, Bybit charges 0.10% maker / 0.10% taker, the industry default, the same as Binance, KuCoin, BingX, and Bitget. Bybit doesn't have a self-branded exchange token, but you can cut fees by up to 25% on spot and 10% on futures by paying with MNT (Mantle, the network it backs), on top of the VIP volume tiers. Its referral code, though, doesn't come with a fee discount.

Futures fees sit at 0.02% maker / 0.055% taker, slightly above Binance and BingX (both 0.05% taker) and well above MEXC (0.02%). At Supreme VIP (around $500M monthly volume), futures makers pay zero.

Withdrawal fees depend on the network more than on the exchange: in our August check, the same USDT withdrawal cost 0.40 on Plasma, 1.00 on Arbitrum or BEP-20, 1.99 on TRC-20 and 5.50 on ERC-20. Most withdrawals clear in 5–10 minutes. One caveat: SEPA fiat withdrawals usually take 1-3 business days, but some user reports describe transfers stuck on "Processing" for 19+ days, so document your withdrawals when the amounts are significant.

Security, and the recovery story

Bybit's security story is the most consequential in crypto. The largest theft in cryptocurrency history happened here, and the recovery was also unprecedented. Both facts deserve equal weight.

On February 21, 2025, North Korean hackers (Lazarus Group, confirmed by the FBI on February 26) compromised a developer at Safe Wallet, the third-party multi-signature provider Bybit used. They injected malicious JavaScript into Safe Wallet's frontend, which altered what transaction signers saw on screen. Several authorized Bybit signers approved what looked like a routine cold-to-warm wallet transfer. In reality, the signed transaction handed wallet ownership to the attackers, draining $1.46 billion in ETH (about 401,000 ETH).

The recovery sequence:

• Within 30 minutes, CEO Ben Zhou went live on X and publicly confirmed the hack.
• Within 10 hours, 350,000+ withdrawal requests were processed, 99.994% cleared.
• Within 24 hours, full withdrawal services were restored and $4B in liquidity support was secured from partners (including a 40,000 ETH ~$105M interest-free loan from Bitget, repaid in 3 days).
• Within 48 hours, a new Proof of Reserves audit by Hacken showed all user assets fully backed.
• Within 72 hours, Bybit covered the deficit from its own reserves and replenished the $1.23B in ETH.

User impact: no funds lost. Every Bybit user who requested a withdrawal during the crisis received their funds. As of early 2026, most of the stolen funds remained traceable on-chain, a portion had been laundered through mixers, and a smaller share was frozen by cooperating exchanges.

After the hack, Bybit commissioned 9 independent security audits, rolled out 50+ new security measures, and runs monthly Proof of Reserves independently verified by Hacken, now past its 36th consecutive report (mid-2026), with reserve ratios above 100% across major assets. Its core infrastructure uses Triple-Layer Protection (multi-signature + TEE + TSS), and authentication supports Google Authenticator, YubiKey, biometrics, and FIDO passkeys.

The unresolved gap: Bybit has a derivatives Insurance Fund that covers extreme liquidation losses, but no SAFU-style reserve dedicated to covering user balances in a security breach (unlike Binance's $1B SAFU or Bitget's dedicated protection fund). February 2025 proved Bybit can recover from a catastrophic breach, but the recovery leaned on emergency loans and internal reserves rather than a pre-funded mechanism. For anyone holding significant funds long term, that matters.

The security takeaway: Bybit's record isn't spotless, but its crisis response was one of the strongest the industry has seen. For active trading, that's a plus. For holding large balances long term, it's more complicated, precisely because there's no dedicated breach fund.

Verification, deposits, and getting started

On KYC, Bybit now sits closer to Binance and Bitget: without verification, almost nothing is available.

KYC tiers:

• Unverified: effectively no access.
• Level 1 (Standard): government ID + selfie, up to 1,000,000 USDT/day, full access to fiat services and most products.
• Level 2 (Advanced): Level 1 + proof of address, up to 2,000,000 USDT/day.

Level 1 usually clears in about 15 minutes and unlocks fiat deposits and withdrawals (SEPA, SWIFT, card), P2P trading, Bybit Earn, and Launchpad.

Deposit options: crypto across 100+ networks (free, instant after confirmations); card via Visa, Mastercard, or Apple Pay (2-4% third-party fees, instant); SEPA bank transfer in EUR (1-3 business days); SWIFT in major currencies (1-5 business days); and P2P across 60+ local currencies and 300+ cryptocurrencies.

What Bybit does better than competitors

MT5 integration, with forex and commodities. Bybit was the first major crypto exchange to integrate MetaTrader 5, the standard platform for forex and commodity traders. Through MT5 you trade 61 forex pairs, metals, commodities, and stock indices from a single Bybit account, with up to 500x leverage on forex, plus 90+ technical indicators and Expert Advisors (algorithmic bots). Few, if any, other top-tier crypto exchanges offer this. For multi-asset traders who want crypto perpetuals alongside EUR/USD or gold, Bybit is the only practical option among the majors.

A MiCA license ahead of Binance. Bybit secured its EU MiCA license through Austria in July 2025 and launched Bybit.eu (headquartered in Vienna, operating across the 29 EEA countries), putting it ahead of Binance, which applied in January 2026 and is still pending. For European traders, that's a clear regulatory edge, especially next to BingX (thin licensing) or HTX (no major Western licenses).

A Unified Trading Account with 70+ collateral assets. The UTA brings spot, margin, USDT/USDC perpetuals, futures, and options into one account. The standout feature is cross-collateralization: you can use 70+ cryptocurrencies as margin across all products, and unrealized profit from one position serves as margin for new ones, with no manual sub-account transfers. Three margin modes are available: Isolated, Cross, and Portfolio Margin. Binance offers a similar system, but Bybit's supports a wider collateral base.

The highest Trustpilot rating among major exchanges. As of June 2026, Bybit sits at around 3.1/5 on Trustpilot, noticeably higher than Binance, BingX, Bitget, KuCoin, and HTX, which all sit in the 1-2 range. One nuance: the separate Bybit.eu entity is rated much lower, around 1.6/5, with the same complaints about fiat delays and reviews.

One of the best mobile apps among major exchanges. 4.7/5 on iOS (46,000+ reviews) and around 4.5/5 on Android (1.3M+ reviews), with full desktop parity, the TradeGPT AI assistant (5M+ users), and TradingView charts.

Three copy-trading modes. Classic (100 USDT minimum, 10-15% profit share), Pro (500 USDT minimum, up to 30% profit share), and TradFi (forex and commodities via MT5). 13,000+ master traders are available, and you can follow up to 10 at once. Smaller in scale than Bitget's copy ecosystem, but the structural variety, including TradFi copy trading, is unique.

Where Bybit falls short

A higher futures taker fee. At 0.055% taker, Bybit is above Binance and BingX (both 0.05%), so active futures traders pay a bit more here than at those peers.

Account-freeze and compliance complaints. The one-star reviews cluster around the same themes: vague "compliance hold" explanations that drag on for weeks, P2P disputes resolved against the buyer, fiat-withdrawal delays, and Enhanced Due Diligence reviews that run 2-3 months and sometimes end in account rejection. The Bybit Card has its own pattern of complaints, from unauthorized charges to blocked cards and frozen reward points.

Major market exits. Bybit fully exited France in January 2025 and is winding down its Japan operations through 2026 under FSA pressure, having paused new Japanese registrations in October 2025. It's restricted in the US, Canada, the UK (spot only, via an FCA-regulated Archax partnership), mainland China, Hong Kong, and Singapore.

Web3 services largely shut down. In May 2025, after the hack, Bybit closed several Web3 lines (the NFT marketplace, IDO platform, Cloud Wallet, and DEX Pro) and refocused on its core products. If you relied on those features, they're gone.

How Bybit compares

Bottom line

Bybit earns 8/10 from us. The combination of top-tier liquidity, MT5 integration, a MiCA license ahead of Binance, the Unified Trading Account, and the highest Trustpilot score among peers makes it one of the strongest top-tier exchanges, especially for European and multi-asset traders.

The main drawback is inconsistent compliance, reflected in the volume of "compliance hold" complaints.

I'd treat Bybit as one of the best exchanges for active trading, derivatives, multi-asset strategies, and EU users. For passively holding large amounts of capital, it's more complicated: the 2025 hack showed the strength of Bybit's response, but it didn't erase the vulnerability itself, or the absence of a pre-funded reserve for cases like it.