Bybit Wallet: Who Holds the Keys, and What the Hack Took

There are two things called a Bybit wallet. Your exchange account is custodial, so Bybit holds the keys. The Seed Phrase Wallet in the app is self custody, and Bybit cannot recover it. The Cloud and Keyless wallets shut on 31 May 2025. The February 2025 hack hit Bybit’s own Ethereum cold wallet, not customer phrases.

On this page: every Bybit wallet product in one table with who holds the keys and its status today, the 2025 hack dated from the FBI notice and Bybit’s own timeline, and what 23 Trustpilot reviews from September 2026 report about moving coins out.

Checked on 1 November 2026 against Bybit’s own help centre, the FBI’s public notice, the Safe Ecosystem Foundation’s statement and one page of Trustpilot reviews. The only question here is a practical one: whose keys your coins sit behind. Nothing below is a view on Bybit as a place to keep money.

Which Bybit wallet are you actually using?

Probably the exchange account, because that is what most people mean. When you deposit bitcoin to Bybit, the coins land in addresses Bybit controls and your balance becomes a line in Bybit’s books. That is custody, exactly like the accounts in our piece on Coinbase, Kraken and Robinhood.

The confusion comes from the second product. Inside the same app sits a separate Web3 section, now branded Bybit Wallet, which used to offer three different wallets with three different answers to the key question. Bybit’s own comparison page, last updated 20 October 2025, spells them out. For the Seed Phrase Wallet, “users maintain full control over their seed phrases and private keys”. For the Cloud Wallet, a “third party (Bybit)” managed the keys on your behalf. The Keyless Wallet split the key into two shares, one held by Bybit and one encrypted on your iCloud or Google Drive. Bybit rated them High, Low and Medium for safety, which is refreshingly blunt.

If you are not sure which one holds your coins, there is a quick test. If you were ever shown a list of words and told to write them down, you have a Seed Phrase Wallet. If you only ever logged in with an email and a password, the keys are not yours. The same split runs through Binance’s exchange and Web3 wallet and Bitget’s family of wallets; exchanges like to offer both under one logo.

What happened to the Cloud and Keyless wallets?

They are gone. Bybit’s discontinuation FAQ, last updated 25 November 2025, says “Cloud Wallet, Keyless Wallet, DexPro, NFT, and Swap & Bridge services will be officially shut down” on 31 May 2025 at 12:00 UTC, after NFT Pro, the Inscription Marketplace and the IDO pages went offline on 8 April 2025. The seed phrase wallet, airdrops, staking and the DApp browser were left running.

The FAQ told holders to move their assets before the cutoff and added: “Failure to do so may result in asset loss.” For Keyless Wallets there was a way out called Private Key Emergency Escape, which converts the MPC wallet into an ordinary seed phrase wallet from a banner in the app, confirmed with the device password. The FAQ says it is not available for Cloud Wallets. And for anyone who missed the date, it warns that users who have not completed the transfer “may be required to complete KYC verification on Bybit” to reach what is left.

That last line is the whole lesson of the Keyless design in one sentence. A wallet marketed as non custodial ended with its users needing the company’s permission, and an identity check, to finish leaving. As with Zengo’s phraseless wallet, a key share held by a company makes the company part of your recovery plan.

What did the 2025 Bybit hack actually take?

Bybit’s own coins, held for its customers, from one Ethereum cold wallet. According to Bybit’s incident timeline, dated 3 March 2025, the exploit happened on 21 February 2025 at 14:13 UTC during a routine transfer, and took 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH, about $1.46 billion. The FBI’s public notice of 26 February 2025, alert I-022625-PSA, is titled “North Korea Responsible for $1.5 Billion Bybit Hack” and names the activity TraderTraitor. It adds that the thieves had already converted some of the haul to bitcoin.

How it happened matters more than the size. The Safe Ecosystem Foundation’s statement of 28 February 2025 says the attack came through “a compromised Safe{Wallet} developer machine” that proposed a disguised malicious transaction, and that external forensic reviewers found no vulnerability in the Safe smart contracts. Bybit’s signers approved what their screens showed them, and their screens were lying. Bybit’s timeline quotes preliminary reports from Sygnia and Verichains that found “no vulnerability” in Bybit’s own infrastructure.

What it did not touch: nobody’s seed phrase. A Seed Phrase Wallet’s keys never sat in that cold wallet, so they were not in the blast radius. Exchange customers were exposed in a different way, because their balances were Bybit’s promise rather than their own keys. Bybit says withdrawals were never halted and that it processed 99.994% of over 350,000 requests within 10 hours. Those are Bybit’s figures; we have not seen an independent count.

The awkward irony is that the hack is the best argument for self custody anyone has made this decade, and it was made against an exchange that sells a self custody wallet. Credit to Bybit for keeping it open. The not your keys lecture lands harder when the exchange is the one delivering it.

Does the Bybit Seed Phrase Wallet hold bitcoin, and is its backup safe?

Bybit’s Seed Phrase Wallet FAQ, last updated 20 October 2025, does not list its supported networks, and the comparison page sends readers to the wallet itself for the chain list. We could not confirm from Bybit’s own pages which bitcoin address types it supports, so check inside the app before you send any bitcoin to it.

The backup is the part to read twice. Bybit states it “cannot help find your Seed Phrase or reset recovery passwords”, which is correct for a self custody wallet. But the same FAQ suggests backing up the phrase “online, on your Google/iCloud drive, or offline, on a physical notebook”. A phrase stored in a cloud account is only as safe as that account’s password and recovery email. A phrase written on paper or steel and kept offline does not have that weakness. The cloud copy is a convenience Bybit offers; it is not the safer of the two. How people actually lose a recovery phrase covers the cloud and screenshot routes in detail.

What do people report when moving coins off Bybit?

We read 23 Trustpilot reviews about withdrawals or account restrictions on one page of Bybit’s reviews, posted between 13 and 16 September 2026 and read on 1 November 2026, plus two Reddit threads. This is testimony, not evidence: review pages attract complaints, and none of these accounts can be checked from outside. But the pattern was unusually consistent.

Most described the same sequence. A small withdrawal to an outside address, often 15 to 60 USDT, was rejected because Bybit’s system rated the destination as high risk. Then the whole account was restricted. One reviewer from Switzerland said a 57.48 USDT withdrawal was rejected and returned within 82 seconds, yet about $11,134 stayed frozen. One from Germany said a 2,201 USDT transfer to a verified wallet was cancelled and the account blocked. Several were still waiting weeks later.

On Reddit, a poster in r/ByBitCommunity said their account had been restricted since 20 July 2026 after a withdrawal to an address linked to the HTX exchange, with six support cases opened and no timeframe by late September. Not every account holds up: a December 2025 post in r/btc about a frozen transfer to Trust Wallet was dismissed by commenters as a disguised advert for paid address scanners.

Bybit’s replies on Trustpilot said long timelines are “not typical” and passed cases to compliance. Its withdrawal FAQ, last updated 12 April 2026, agrees with the pattern more than it disagrees: a withdrawal “may be rejected if the address is deemed high risk”, and your account “may be imposed a withdrawal restriction until additional verification documents are provided via email”. What the FAQ does not mention is how long the wait can run.

How do you move coins from Bybit to keys you hold?

First, set up the destination wallet and write its recovery phrase on paper before anything is sent. A wallet with no written backup is lost the day the phone is lost.

Second, expect the Travel Rule question. Bybit’s Travel Rule FAQ, last updated 23 August 2026, says verification is required for every crypto deposit and withdrawal. For a personal wallet you answer “Whose wallet is this?” and tick a confirmation box. It does not ask for a phrase, a private key or a signature, and nothing honest ever will.

Third, send a small test amount, check it arrived at the address your own wallet shows, and only then send the rest. A test does not avoid Bybit’s address screening: in the accounts above, even small flagged withdrawals led to whole account restrictions. It only limits how much is in transit if the address is wrong.

Fourth, if a withdrawal is rejected, use Bybit’s official in app support only. Account freezes attract fake recovery agents in comment sections and direct messages. Anyone who asks for your seed phrase or private key to unlock a Bybit account is stealing, not helping.

Frequently asked questions

This article is general information about wallet security and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything, or to use or leave any exchange. Speak to a suitably qualified professional about your own situation, and remember that in self custody the security decisions are yours alone.