Bybit

Our assessment

Bybit is the venue in this table with the most consequential recent history. In February 2025 it lost roughly $1.4bn in the largest exchange exploit on record. It also holds a MiCA authorisation from Austria's Financial Market Authority, publishes monthly proof of reserves, and — by the available reporting — left no customer out of pocket. All of that belongs in the same assessment.

What happened, and what followed

The exploit was extraordinary in size. The response is the part a prospective user should weigh: withdrawals continued, customer balances were made whole, and the incident was disclosed rather than minimised. Around $644m of the stolen assets remained untraceable by later reporting, so this was absorbed by the company rather than recovered.

How our rubric treats it

Gate G3 caps any provider with unreimbursed user losses and no published remediation at 6.0. Neither condition holds here, so the gate does not trigger and the incident is recorded as a partial on the custody pillar instead. That is a deliberate judgement: a platform that covers a nine-figure loss and says so publicly is demonstrating something real about its balance sheet and its disclosure practice, even as the event itself weighs against it.

The rest of the picture

The Austrian MiCA authorisation, obtained in May 2025 with an EU base in Vienna, gives it passporting across the European Economic Area. Reserves are published monthly. On independent market data it carries a trust score of 9 with 24-hour volume above every venue here except Binance. Fee documentation was the weakest area — we could not capture rates or tier thresholds at this check.

Who it suits

Bybit fits active traders who want depth and derivatives access from an EU-authorised venue, and who have read the 2025 incident and formed their own view of it. Readers for whom a single event of that magnitude is disqualifying have five higher-scoring alternatives in this table, and that is a reasonable position to hold.