Bybit Background Check Report

Entity type: crypto exchange
Last updated: May 7, 2026

1. Entity Overview

Founded: Bybit was registered in March 2018 and launched its first BTC/USD inverse perpetual contract in December 2018. [1][2]

Operating entities: The key entities are Bybit Fintech Limited, the main company registered in the British Virgin Islands; Bybit Fintech FZE, the Dubai-based operating headquarters; and BTG Technology Holdings Limited, an affiliated derivatives entity that has appeared in regulatory warnings across several jurisdictions. [1][3]

Headquarters history: Bybit operated from Singapore between 2018 and 2022, then moved its headquarters to Dubai, United Arab Emirates, in 2022. [1]

Founder / CEO: Ben Zhou is Bybit’s co-founder and CEO. Earlier CoinMarketCap material described him as a University of Pennsylvania graduate who spent seven years at XM, one of China’s largest forex brokers. [4] A different version on Wikipedia describes him as a “Singaporean entrepreneur.” [1] This report treats the founder background as having conflicting public versions rather than as one settled profile.

Public shareholder information: Bybit is privately held, and its full shareholder structure cannot be verified from public records. PitchBook lists known investors including Fenbushi Capital, Block Infinity, DWF Labs, iAngels, Jets Capital, and others, with 19 investors shown in total. The latest listed transaction relates to the Stable Foundation seed round. [5] This is a list of known investors, not a complete shareholder register.

Unverified allegation: In April 2026, X user @forevergalxy, who presents himself as a crypto-industry commentator, publicly alleged that Hu Xiaowei was not only an important Bybit business partner but also one of Bybit’s significant shareholders. [33][34] Hu Xiaowei is linked to Prince Group and was sanctioned by the UK FCDO/OFSI on March 26, 2026, for involvement in the group’s financial money-laundering network. His known aliases include “Chen Xiaoer,” listed first alphabetically on the U.S. OFAC sanctions list, and “Hu Yanming.” [35][36][37]

As of the date of this report, that shareholder allegation has not been independently supported by BVI corporate registry shareholder filings, independent investigations by major financial media such as Bloomberg, Reuters, Caixin, or HK01, official disclosures by OFAC, OFSI, or regulators in other jurisdictions, court documents directly naming Hu as a Bybit shareholder, or any public admission or denial by Bybit. This report records the existence of the allegation but does not treat it as proven fact.

Affiliated investment arm: Mirana Ventures is Bybit’s in-house early-stage crypto fund. It invests between $200,000 and $20 million and focuses on projects strategically relevant to BitDAO and Bybit. [6] Mirana later became one of the flashpoints in the FTX bankruptcy case; see Section 4.

Product stack: Bybit offers spot trading with 600+ tokens and 760+ trading pairs; derivatives including BTC, ETH, SOL, and other perpetual contracts with leverage up to 100x; options; copy trading; Bybit Earn; a Web3 wallet; an NFT marketplace; Buy Crypto OTC; and TradFi products, including tokenized U.S. stock futures that reportedly reached $10 billion in cumulative trading volume by December 2025. [7]

Current operating status: Bybit sits in the upper tier of offshore crypto exchanges, though not in the same regulatory category as Coinbase. CoinMarketCap describes it as the world’s second-largest crypto exchange by trading volume, and Bybit says it has more than 60 million users globally. [4]

Brand sponsorships: Bybit sponsored Oracle Red Bull Racing in Formula 1 through a three-year, $150 million deal that ended in late 2024. It has also sponsored Borussia Dortmund, Natus Vincere, Astralis, and several projects in Malaysia. [1][8]

2. Licenses and Compliance

Bybit’s compliance history follows a repeated pattern: expansion, warnings, exits from some markets, and new applications or registrations elsewhere.

Bybit’s regulatory footprint in plain language:

• Dubai, UAE: VARA VASP license, this is the main operating license with medium-to-high weight.
• Cyprus: VASP registration, medium weight.
• Kazakhstan: VASP license, medium weight.
• Georgia: Tbilisi Free Zone registration, low weight.
• Malaysia: removed from the Securities Commission investor-alert list in 2025 and re-entered through a stake in local dual-licensed exchange Hata, low-to-medium weight.
• United States: not licensed, service prohibited.
• United Kingdom: exited in 2023.
• France: exited in 2024.
• Canada: exited in some provinces in 2023.
• Mainland China / Hong Kong: no direct service; VPN-based access by mainland users remains disputed.
• Singapore: no direct service.
• Sanctioned jurisdictions such as North Korea, Cuba, Iran, and Syria: blocked.

Key compliance risk events: [13][14][15][16]

• November 2024: Japan’s Financial Services Agency warned Bybit and four other unregistered offshore exchanges.
• February 2025: Under FSA pressure, Apple’s Japan App Store removed Bybit and several other unregistered exchange apps.
• October 2024: The Dutch central bank, DNB, reportedly fined Bybit €2.2 million for operating without registration. [17]
• December 2024: Bybit publicly acknowledged that mainland Chinese users could register through VPN access and trade with offshore identity documents. CEO Ben Zhou said Bybit would not accept RMB settlement and would not cross the capital-outflow red line recognized by the Chinese government. [12]

License-quality assessment: Bybit’s only clearly meaningful operating license is the Dubai VARA VASP license. Most other registrations are VASP or anti-money-laundering registrations. Bybit is not licensed in, or has exited or been warned in, the United States, the United Kingdom, France, Canada, Japan, and other mature financial markets. For an exchange claiming global number-two scale, that mismatch matters. A meaningful share of its 60 million users likely comes from markets where Bybit is not fully licensed, with access routed through VPNs, offshore identity documents, or other non-standard channels.

3. User Complaint Profile

Main complaint categories: [18][19]

• Withdrawal stress after the February 2025 hack: After the $1.46 billion hack, Bybit faced what it called the largest withdrawal wave in exchange history within 10 hours. It reported that 99.994% of 350,000 withdrawal requests were completed. [20] The remaining 0.006%, roughly 21 mostly large withdrawals, were not publicly detailed.
• Account freezes and delayed KYC reviews: Trustpilot has long recorded complaints about freezes and KYC rechecks, especially during volatile market periods.
• Trading-system outages during extreme market moves: Users have reported being unable to manage positions during major volatility, leading to forced liquidation.
• Ambiguous VPN policy for mainland Chinese users: Bybit accepts certain mainland Chinese identity documents while blocking mainland Chinese IP addresses. That half-open, half-closed model makes dispute resolution unclear for affected users. [12]

Severity: Medium-high. The complaints are systematic, but they are not yet in the same category as an exit scam or a platform that simply seized customer balances. The February 2025 hack is a key distinction: Bybit repaid users and restored reserves within 72 hours.

Third-party assessment: CoinMarketCap, CoinGecko, and similar databases have long placed Bybit in the second tier of top exchanges. Trustpilot ratings are middling to low, mostly driven by operational complaints.

Collective litigation: There is no large public class-action campaign against Bybit at this stage. The largest legal case involving Bybit was the FTX bankruptcy estate’s roughly $1 billion claim, which was settled for $228 million in October 2024. [21]

4. Major Event Timeline

Listed in reverse chronological order.

• April 2026 — Coinbase tokenized-stock talks: Bybit was reported to be in talks with Coinbase over tokenized U.S. stock products. The structure did not involve an equity acquisition. [22] That undercut earlier market rumors from Wu Blockchain that Coinbase was considering a minority stake in Bybit.
• December 2025 — Tokenized U.S. stock futures volume: Bybit reported that cumulative trading volume in U.S. stock futures surpassed $10 billion. [7]
• April 2025 onward — Lazarus Bounty program: Following the February 2025 hack, Bybit continued asset-recovery efforts and launched the Lazarus Bounty program. Within two months, it received 5,443 reports, of which 70 were deemed valid. [23]
• February 21, 2025 — Largest crypto-exchange hack on record: Bybit’s ETH multisig cold wallet lost approximately 401,346 ETH and related assets, worth roughly $1.46–$1.5 billion. The reported attack path was that Lazarus Group exploited a third-party Safe{Wallet} front-end vulnerability, altered the signing interface, and tricked Bybit multisig signers into approving a transaction that replaced the cold-wallet contract logic with a malicious contract controlled by the attackers. [24][25][26][20]
• February 2025 — Emergency reserve restoration: Bybit responded by raising emergency liquidity through Galaxy Digital, FalconX, Wintermute, and other institutions, while large holders and institutions from Binance, Bitget, MEXC, and elsewhere transferred roughly 40,000 ETH in support. Within 72 hours, Bybit restored a reserve shortfall of 446,869 ETH, worth about $1.23 billion. [27] It said 99.994% of withdrawal requests were processed. [20]
• February 2025 — eXch laundering dispute: On-chain analysis showed that part of the stolen funds, more than 29,000 ETH, moved through the mixer platform eXch. eXch publicly refused Bybit’s freeze request, saying its own users had previously been blocked by Bybit. [28]
• October 2024 — FTX settlement: Bybit settled the FTX bankruptcy estate’s roughly $1 billion claim for $228 million. [21]
• June 2024 — Mainland Chinese overseas-user registration: Bybit opened registration for overseas mainland Chinese users. Mainland Chinese IP addresses remained blocked, but mainland identity documents were accepted. [11]
• April 2024 — France exit: Bybit exited the French market. [10]
• November 2023 — FTX bankruptcy estate lawsuit: FTX’s bankruptcy estate sued Bybit and its investment arm Mirana for roughly $1 billion. The complaint alleged that Bybit, through Mirana, used “VIP” channels to withdraw around $500 million shortly before FTX collapsed in November 2022. It also alleged one single Mirana withdrawal of $327 million; claimed that Bybit restricted the FTX estate’s withdrawals from the Bybit platform to $125 million; and alleged that a BitDAO token restructuring caused tens of millions of dollars in losses to FTX’s token holdings. [21][29]
• 2023 — UK and Canada exits: Bybit exited the United Kingdom and parts of Canada. [10]
• 2022 — Headquarters move: Bybit moved its headquarters from Singapore to Dubai. [1]
• Early 2022 — Formula 1 sponsorship: Bybit signed a three-year, $150 million sponsorship deal with Oracle Red Bull Racing. [1]
• December 2018 — First perpetual contract: Bybit launched its first BTC/USD inverse perpetual contract. [2]
• March 2018 — Incorporation: Bybit Fintech Limited was incorporated in the British Virgin Islands. [1]

5. Risk Score

risk_score: 6 / 10

Deductions

• (-2) The largest crypto-exchange hack in history. In February 2025, $1.46 billion in ETH was stolen from a Bybit cold wallet. Bybit made users whole and restored reserves within 72 hours, but the incident exposed several structural weaknesses: a compromised Safe multisig front end, an internal signing process that did not defend against front-end tampering, and CEO Ben Zhou acknowledging that he was the final signer and still did not catch that the transaction called a malicious contract. [24][25][26]
• (-1.5) FTX bankruptcy claim and $228 million settlement. The FTX bankruptcy estate accused Bybit’s investment arm, Mirana, of using “VIP” access to withdraw assets from FTX ahead of ordinary customers. [21][29] Bybit later settled for $228 million without admitting all allegations.
• (-1) Regulatory exits and warnings in major markets. Bybit has exited or faced warnings in the United Kingdom in 2023, France in 2024, parts of Canada in 2023, Japan through a 2024 FSA warning and a 2025 Apple App Store removal, and the Netherlands through a reported fine. [10][13][14]
• (-1) Grey-zone access policy for mainland Chinese users. Bybit accepts mainland Chinese identity documents while blocking mainland IP addresses and effectively leaving VPN access to users. [11][12]
• (-0.5) Opaque shareholder and UBO structure. A BVI registration plus a PitchBook investor list is not a verified shareholder register or ultimate-beneficial-owner disclosure. The Hu Xiaowei allegation described in Section 1 makes transparency more important, not less.

Credits

• (+1.5) Solvency under the worst hack ever recorded. After the $1.46 billion theft, Bybit reportedly restored $1.23 billion through external financing within 72 hours and processed 99.994% of withdrawal requests. [27][20]
• (+1) Public recovery effort and intelligence coordination. Bybit launched the Lazarus Bounty program, worked with Arkham, ZachXBT, Elliptic, and other on-chain intelligence firms, and publicly named the mixer platform eXch. [23][28]
• (+0.5) Crisis financing relationships with institutional crypto counterparties. Being able to raise hundreds of millions of dollars in ETH bridge liquidity within 72 hours, including through counterparties such as Galaxy Digital, FalconX, and Wintermute, is evidence of institutional credit.
• (+0.5) Strong product and technical depth. Bybit remains first-tier in options, derivatives liquidity, and copy-trading infrastructure.
• (+0.5) Post-hack technical hardening. After the February 2025 incident, Bybit added additional security controls, including MPC wallets, front-end signing isolation, and alternatives to Safe.

Core Risk View

Bybit’s risk has two layers. The first layer is normal offshore-exchange risk: regulatory pullbacks, opaque beneficial ownership, and grey-zone market access. The second layer is event risk. The February 2025 hack proved that Bybit once came close to a catastrophic cold-wallet failure caused by a third-party front-end compromise. The Mirana dispute in the FTX bankruptcy case suggested that when another exchange was under stress, Bybit-linked capital may have moved to protect itself first.

In March 2026, after the UK sanctioned Prince Group-linked figure Hu Xiaowei, claims appeared on X alleging that he was an important Bybit shareholder. [33][34] There is currently no independent proof of that allegation, and Bybit has not publicly responded. Treat it as a watch item, not as established fact. If regulators, courts, or major media later confirm it, Bybit’s risk rating would need to move materially higher.

User Perspective

After the February 2025 hack, Bybit’s large-balance safety profile returned to the same conversation as Coinbase and Kraken: proof-of-reserves disclosures, security upgrades, and user-protection mechanisms are now in place.

But BVI registration, repeated regulatory exits, and the Mirana-FTX withdrawal dispute mean Bybit should not be used as a long-term vault for excess assets that are not needed for trading.

For medium-sized active trading, especially derivatives and options, Bybit remains a top-tier venue.

Users in the United States, the United Kingdom, Canada, France, Japan, Singapore, and Hong Kong should be especially careful. If Bybit is not permitted to serve your jurisdiction and you access it through a VPN or offshore identity workaround, your practical recovery options in a dispute may be close to zero.

Sources

[1] Wikipedia, “Bybit” — https://en.wikipedia.org/wiki/Bybit
[2] BlockWeeks, “What does Bybit do? A guide to the derivatives exchange” — https://blockweeks.com/docs/exchange/bybit
[3] ASIC Investor Alert, BTG Technology Holdings Limited affiliated-entity identity; original URL not provided.
[4] CoinMarketCap, “Bybit Exchange Profile” — https://coinmarketcap.com/exchanges/bybit/
[5] PitchBook, “Bybit 2026 Company Profile” — https://pitchbook.com/profiles/company/234748-45
[6] RootData, “Mirana Ventures Overview” — https://www.rootdata.com/Investors/detail/Mirana%20Ventures
[7] Datawallet, “Bybit Supported and Restricted Countries (2026)” — https://www.datawallet.com/crypto/bitget-restricted-countries
[8] Bybit LinkedIn company page — https://www.linkedin.com/company/bybitexchange
[9] CryptoNews, “Crypto exchange ByBit removed from Malaysia’s investor alert list” — https://cryptonews.net/news/market/32788494/
[10] BlockWeeks, Bybit exited Canada and the UK in 2023 and France in 2024; original URL not provided.
[11] SCMP, “Major crypto exchange Bybit opens up to Chinese users based overseas” — https://www.scmp.com/tech/blockchain/article/3265787/bybit-major-cryptocurrency-exchange-opens-trading-chinese-users-living-overseas
[12] SCMP, “Bybit crypto exchange says mainland Chinese can trade through VPN, but not with yuan” — https://www.scmp.com/tech/blockchain/article/3289336/bybit-crypto-exchange-says-mainland-chinese-can-trade-through-vpn-not-yuan
[13] BeInCrypto, “Japan FSA Warns KuCoin, Bybit, Bitget, and Others Over Unregistered Operations” — https://beincrypto.com/japan-fsa-warns-unregistered-crypto-exchanges-kucoin-bybit-bitget/
[14] CryptoRank, “Japan removes Kucoin, Bitget, and other unregistered crypto exchanges from app stores” — https://cryptorank.io/news/feed/9dc1c-japan-removes-crypto-exchanges-fsa-request
[17] Dutch central bank DNB fine record, industry-cited; requires independent verification.
[18] Trustpilot, Bybit reviews and user complaint aggregation; original URL not provided.
[19] Coin Bureau, Bybit review series; original URL not provided.
[20] Baihua Blockchain / Medium, “Breaking: Bybit platform loses $1.5B in assets; seven unexpected details” — raw URL truncated: https://medium.com/@HelloBTC365/…
[21] Yahoo Finance, “FTX Bankruptcy Estate Files Lawsuit Seeking Recovery of Nearly $1 Billion from ByBit” — https://finance.yahoo.com/news/ftx-bankruptcy-estate-files-lawsuit-055118850.html
[22] ABMedia, “Coinbase and Bybit reportedly cooperate on tokenized U.S. stocks” — https://abmedia.io/coinbase-bybit-tokenized-us-stocks-custody-distribution-collaboration
[23] IQ.wiki, “ByBit” — https://iq.wiki/wiki/bybit
[24] SlowMist, “The hacking method and open questions behind Bybit’s nearly $1.5B theft” — https://finance.sina.com.cn/blockchain/roll/2025-02-23/doc-inemmyam3318852.shtml
[25] Web3Caff, “Full analysis of the Bybit $1.44B theft” — https://web3caff.com/archives/119011
[26] CSDN, “Crypto exchange Bybit hacked, losses exceed $1.5B” — https://blog.csdn.net/androidstarjack/article/details/145819131
[27] Beosin / Web3Caff, Bybit reportedly obtained about 446,869 ETH, approximately $1.23B, through loans, large-holder deposits, and ETH purchases; original URL not provided.
[28] Sina Finance, “Has a mixer become a laundering hub? A closer look at eXch in the Bybit hack” — https://finance.sina.com.cn/blockchain/roll/2025-02-25/doc-inemrzsu0150482.shtml
[29] Yahoo Finance / Bloomberg, summary of the FTX bankruptcy estate complaint; separate original URL not provided.
[30] GOV.UK, “UK and US take joint action to disrupt major online fraud network” — https://www.gov.uk/government/news/uk-and-us-take-joint-action-to-disrupt-major-online-fraud-network
[31] Elliptic, “Prince Group targeted with $15B crypto seizure and sanctions for pig butchering operations” — https://www.elliptic.co/blog/prince-group-targeted-with-crypto-sanctions-for-global-pig-butchering-operations
[32] Chainalysis, “DOJ Seizes $15 Billion in Bitcoin from Cambodia-Based Prince Group Fraud Empire” — https://www.chainalysis.com/blog/southeast-asia-crypto-scam-network-mining-pig-butchering-october-2025/
[33] X post by @forevergalxy alleging links between Hu Xiaowei and Bybit — https://x.com/forevergalxy/status/2052236293946446257
[34] X thread by @forevergalxy alleging Hu Xiaowei–Bybit connections — https://x.com/forevergalxy/status/2052217018867409328
[35] HK01, “Prince Group Chen Zhi investigation: UK-sanctioned behind-the-scenes figure Hu Xiaowei, No. 8 Park, Wan Kuok-koi” — https://global.hk01.com/01%E4%BE%A6%E6%9F%A5/60334830/
[36] HK01, “Big Boss behind Prince Group’s Chen Zhi exposed; changed name four times; controlled listed-company charity foundation” — https://global.hk01.com/01%E4%BE%A6%E6%9F%A5/60330041/
[37] Caixin, “Hu Xiaowei, figure linked to Cambodia’s Prince Group, sanctioned by the UK” — https://china.caixin.com/2026-03-27/102428199.html