Bybit Fintech Limited

Who owns Bybit?

Bybit is owned by Bybit Fintech Limited, a private company incorporated in the British Virgin Islands and headquartered in Dubai. Founder Ben Zhou holds the controlling position and serves as CEO. The shareholder register is private.

Is Bybit a public company?

No. Bybit is privately held, has no stock listing, and has never conducted a public equity offering. Users seeking exposure cannot buy shares.

When was Bybit founded?

Ben Zhou founded Bybit in March 2018 as a crypto derivatives exchange. It added spot trading and consumer products over the following years and moved its headquarters to Dubai in 2022.

How big is Bybit?

Bybit had more than 80 million registered users at the end of 2025, generated about $1.5 trillion in trading volume for the year, and holds an 8.1 percent share of global exchange volume, ranking it second worldwide behind Binance.

What happened in the Bybit hack?

On February 21, 2025, attackers attributed to North Korea's Lazarus Group stole roughly $1.5 billion in ETH by compromising a Safe multisig wallet's signing process. Bybit covered the loss, maintained withdrawals, and lost no customer funds.

Where is Bybit headquartered?

Bybit is headquartered in Dubai, United Arab Emirates. The legal holding entity is incorporated in the British Virgin Islands, and regulated subsidiaries operate in Dubai, the European Union, India, and other licensed markets.

Ben Zhou founded Bybit in March 2018 after a career running a forex brokerage. The founding insight was infrastructural: BitMEX then dominated crypto derivatives but repeatedly crashed during volatility spikes, liquidating traders who could not act. Zhou built Bybit around a matching engine designed to stay online during liquidation cascades.

The pitch worked. Bybit grew through the 2018 to 2021 cycle into a top-three derivatives venue, then layered on spot trading to compete for the full retail relationship. Product expansion ran wide: Bybit Earn for yield, a launchpad for new token listings, the Bybit Card, copy trading for less experienced users, and a Web3 wallet division.

Geographic strategy shifted as regulation did. The company originally operated from Singapore, then announced Dubai as its global headquarters in 2022 as the UAE built a dedicated virtual asset regulatory framework under VARA. In September 2024 Bybit received a provisional, non-operational approval from VARA for retail, qualified investor, and institutional services, the first step toward a full Dubai license.

The February 21, 2025 hack is the defining event in company history. Attackers, attributed to North Korea's Lazarus Group, compromised the signing flow of a Safe multisig wallet during a routine cold-to-warm transfer and drained roughly 400,000 ETH, about $1.4 to $1.5 billion. It was the largest theft in crypto history. Zhou went live within an hour, the exchange processed more than 350,000 withdrawal requests in 12 hours, bridge loans and reserves covered the hole, and client funds were kept whole under Bybit's 1:1 reserve guarantee. The company posted a $140 million bounty and published a live tracker of flagged hacker wallets.

The recovery proved durable. Bybit ended 2025 with more than 80 million users, retained its number two global ranking, secured authorization under the EU's MiCA framework through an Austrian entity to launch Bybit EU, and registered with India's Financial Intelligence Unit to resume lawful operations there. Through 2026 the company continued pushing into TradFi products, offering gold, forex, and index trading alongside crypto.

The February 21, 2025 Lazarus Group hack dominates the record. Approximately 400,000 ETH worth $1.4 to $1.5 billion was stolen through a compromised Safe wallet signing interface, the largest theft in crypto history. Bybit absorbed the loss through reserves and partner loans, kept withdrawals running, and suffered no client losses. Most stolen funds were never recovered.

Regulatory history includes a 2022 settlement with Ontario's securities regulator, warnings in Japan, a UK retail derivatives restriction under FCA rules, and a French authorization that arrived only in 2025 after earlier warnings. India required FIU registration and a penalty payment before operations resumed lawfully in 2025.

Post-hack scrutiny focused on counterparty risk in multisig infrastructure providers, an industry-wide issue the Safe integration exposed rather than a Bybit-specific failing, though the scale was uniquely Bybit's.