Is the Bybit app trustworthy? Security checks and the 0.1% spot fee

Check who is asking you to act

Bybit's account-security guide recommends its Authenticity Check for domains, email addresses, phone numbers, URLs and social-media accounts associated with the brand. Use that check when a message claims to be support, a recruiter or a service representative. Save the exact address or account identifier you are checking; a display name alone does not identify the sender.

The guide also recommends an anti-phishing code. After you configure one, Bybit says it appears in its official emails and text messages. If a message has a missing or incorrect code, the guide says it may be fraudulent and tells users not to follow its links or instructions. Report the message through the service's reporting route instead of replying with account information.

Treat those two checks as separate tasks. Authenticity Check examines a source identifier. An anti-phishing code checks an expected feature of a message after you have enabled the setting. Neither is a reason to share a password, verification secret or account access with the person contacting you. Bybit's guide explicitly says to keep personal account details confidential.

Source: Bybit Help Center, “How to Enhance the Security of Your Account”, bybit.com, updated 23 May 2026; retrieved for this article on 4 November 2026 SGT.

Put account controls around the login

The security guide recommends Google two-factor authentication for the Bybit account and for the linked email account. That second instruction matters when you are reviewing the whole sign-in path: write down whether both accounts have their own protection, rather than ticking a single box labelled security. Follow the setup instructions inside the account rather than a link sent by an unknown contact.

Bybit describes the fund password as separate from the login password and says it is required for security verification and withdrawal requests. Check whether you have configured it. A password used to enter an account and a password requested for a fund-related action have different roles; knowing which screen is asking avoids treating every password prompt as interchangeable.

The same guide describes passkeys using device biometrics and Secure Transaction Approval, which designates a primary device for approving high-risk actions. Review which device holds that role and whether you recognise it. The existence of a feature in a help article does not tell you whether your own account uses it. Your task is to inspect the current setting and its associated device.

Do not change several unfamiliar settings in a rush because a stranger says an account must be “verified” immediately. Open the security page yourself, read each setting and keep recovery arrangements under your control. This is an order of checks derived from the documented controls, rather than a claim that we inspected your account.

SponsoredBybit

Partner rebate share30%Up to

Check regional eligibility and account terms

✓Code applied automatically by the sign-up link: 48553

Sign up on Bybit →Code48553Copied

Review trusted devices before the next transfer

Bybit's guide gives the app route as User Center, Security, Trusted Devices. It tells users to remove devices they do not recognise and submit a report through Authenticity Check for investigation. Record what prompted the concern before making a transfer: an unfamiliar device entry is a concrete item to address, while a general impression that the app looks normal is not.

The guide says users receive a notification when the system detects a login attempt from an unrecognised device after removal. Do not confuse that notification with a completed investigation or a recovery of funds. The documented action is to remove the entry and report suspicious activity; the article does not promise a particular investigation result.

For new withdrawal destinations, the New Address Withdrawal Lock restricts a newly added address from use for 24 hours when the feature is enabled. Check the setting before relying on that interval. It is a rule for newly added addresses, not a statement that every withdrawal is held for a day or that any prior transfer can be reversed.

Bybit also advises deactivating an account when a user notices or suspects that it is at risk of being hacked. If that is your situation, use the account-security route you opened yourself. Do not make another deposit to test whether a suspicious account is working. Preserve the device and message details needed for the report.

Read the fee for the product you actually use

A security review should include the transaction you are about to approve. The official trading-fee table lists a VIP 0 base rate of 0.1000% for crypto-to-crypto spot trades. At that rate, a hypothetical US$1,000 trade has a trading fee of US$1: US$1,000 × 0.1000% = US$1. This is arithmetic using the published rate, not a quotation for your account or a withdrawal charge.

The table lists different base rates for perpetual and futures contracts. It also separates special trading zones from ordinary crypto-to-crypto spot trading. Before using a percentage from a headline, match the product label on your order to the corresponding part of the schedule. A rate for one product should not be copied into the cost estimate for another.

The fee page says rates can vary by region and directs users to My Fee Rate after identity verification. If that account screen differs from the public base table, do not replace the account rate with the smaller number because it appears in an article. Keep the product, account tier and applicable rate together when calculating the cost.

Source: Bybit Help Center, “Bybit Trading Fee Structure”, bybit.com, updated 2 September 2026; retrieved on 4 November 2026 SGT. The public table does not confirm Brazilian account eligibility, a local payment method or the cost of a particular withdrawal.

A higher tier needs its own cost calculation

Bybit says VIP levels depend on qualifying asset balance or trading volume over the past 30 days, using whichever qualifies the user for the higher tier. It refreshes levels daily at 07:00 UTC, which is 15:00 SGT. The page also says the order's rate depends on the VIP level when the order is placed, and that subaccounts adopt the main account's fee structure.

Those rules explain why two readers may see different fees. They are not a reason to increase a balance or make extra trades just to obtain a different label. For a transaction you already intend to make, calculate its fee using the rate that applies to it. Compare that amount with the cost estimate you recorded before approving the order.

Keep a fee discount separate from an account-security claim. A cheaper trade does not establish who controls an installation or whether a withdrawal destination is yours. Equally, an enabled security setting does not establish a lower fee. The two official documents answer different parts of the reader's question.

What the available documents do not settle

This review uses the official security guide and trading-fee schedule. It does not verify a specific phone installation, inspect a customer account or establish that the service is authorised for a particular Brazilian resident. No Brazilian licensing claim, deposit rail, local cash-out procedure or current withdrawal limit is inferred from the global help pages.

If your main question concerns a suspicious message, start with the source checks and device list. If it concerns the cost of an intended trade, start with the product and My Fee Rate. Our Bybit profile and comparison entry can help keep the venue identity consistent while you compare the documents. It does not replace the account screen for a transaction-specific decision.

What to check in your Bybit account

1. Open Bybit security settings and check the trusted-device list. Remove an unrecognised entry and use the documented reporting route.
2. Open the intended order, check its product and read My Fee Rate. Calculate the cost before approving it.

Quick FAQ

Does an anti-phishing code make every message genuine?

Bybit says a configured code appears in official emails and text messages and warns that a missing or incorrect code may indicate fraud. Use the documented reporting route for a suspicious message. This feature does not authorise sending account details to its sender.

Is the 24-hour address lock applied to every withdrawal?

The guide describes a lock on newly added withdrawal addresses when the feature is enabled. It does not describe a universal 24-hour arrival time or a way to undo a completed transfer.

Is 0.1000% the fee for every Bybit product?

It is the published VIP 0 base crypto-to-crypto spot rate. Other products have separate tables, and the help page tells users to check My Fee Rate for the rate applicable to their region and account.