Bybit launched Bybit.eu in Austria under MiCA and reported a $1.5 billion security incident in 2025

Bybit, founded by Ben Zhou in 2018 and headquartered in Dubai since 2023, has gone from a derivatives-first venue to a broader crypto trading stack with spot, margin, options, P2P, copy trading, bots, and institutional services. For high-risk PSPs, the relevant part is not the product list; it is the combination of KYC, card access limits in Russia, and a separate European entity now operating under MiCA.

1. Bybit started in 2018 as a crypto derivatives exchange. Over time it added spot trading, P2P, options, trading bots, a Web3 wallet, and DeFi-related services, and it now also offers copy trading, Bybit Earn, and services for institutional clients.
2. Access to Bybit’s products requires identity verification (KYC). The fee structure depends on market type, user tier, and trading volume: spot fees start at 0.1% for both maker and taker, while futures fees are 0.02% for maker and 0.055% for taker.
3. In 2025, Bybit launched a separate European platform, Bybit.eu, which holds a MiCA crypto-asset service provider license in Austria. Bybit EU is headquartered in Vienna.
4. On the security side, Bybit says it uses two-factor authentication, an anti-phishing code, withdrawal address whitelists, and Proof of Reserves reports. For derivatives markets, it also maintains a Bybit insurance fund to cover traders against excessive losses on futures.
5. The largest security incident in Bybit’s history took place on 21 February 2025, when one of the exchange’s Ethereum wallets was affected in an attack that caused losses of about $1.5 billion. According to the source, the attack did not go through the exchange itself but through a compromised computer belonging to a Safe{Wallet} infrastructure developer.

For Russia-linked flows, the mechanics are already constrained: Bybit has a Russian-language interface, is available across most of Russia except some regions, has not allowed top-ups with Russian bank cards since 2022, and routes ruble funding through its P2P market. Since 2025, services of the European arm have been unavailable to Russian citizens.