SECURE YOUR BYBIT ACCOUNT

Protect the exchange account before putting serious value into it.

Bybit provides several layers of account and transaction protection, including Google Authenticator, passkeys, Secure Transaction Approval, withdrawal-address controls and configurable withdrawal limits.

Bybit exchange security is different from wallet security.

This guide covers your Bybit exchange account. A separate self-custody wallet has a different security model and may involve a recovery phrase or private keys.

Never give anyone your password, verification code, authenticator code, recovery phrase or private key.

What should I never share?
Never share your Bybit password, Google Authenticator code, verification code, recovery phrase or private key. Someone claiming to be support does not need these secrets to legitimately help you.
What is Secure Transaction Approval?
Secure Transaction Approval lets you designate a primary phone that can review and approve transactions initiated from the Bybit website or another device. If the request is not yours, you can reject it instead of approving it.
What is the 24-hour new-address withdrawal lock?
Bybit can place a withdrawal ban on newly added wallet addresses for 24 hours. This creates a delay between adding an address and being able to withdraw to it.
Why can't I withdraw after changing a security setting?
Bybit currently applies a 24-hour withdrawal restriction after several sensitive security changes, including changing the password, disabling Google Authenticator, changing the Fund Password or removing passkeys. This is designed to protect assets after security changes.
What if someone says my Bybit account is at risk?
Stop and verify independently. Do not follow their links, disclose security codes, install software or transfer funds to a supposed secure or recovery wallet. Open Bybit yourself and use its official support channel.
BYBIT EXCHANGE SECURITY

Build the security layers before you need them.

Work through the controls one at a time. After changing a setting, verify that the protection is actually active.

Use a strong, unique Bybit password

Your Bybit password protects access to an account that may control valuable assets. Never reuse it on another important service.

Click to see protection steps

Step-by-step

  1. Open Bybit through the official app or website.
  2. Open Account → Security.
  3. Find the option to manage your login password.
  4. Create a strong password using a combination of uppercase and lowercase letters, numbers and symbols.
  5. Make the password unique to Bybit.
  6. Store it in a trusted password manager.

VERIFY: Confirm that your Bybit password is unique and is not reused for your email, banking or other important accounts.

Enable Google Authenticator 2FA

Bybit strongly recommends binding Google Authenticator to your account as an additional layer of protection.

Click to see protection steps

Step-by-step

  1. Open Account → Security.
  2. Find Google Two-Factor Authentication.
  3. Start the setup process and complete the requested email or SMS verification.
  4. Open Google Authenticator on your phone.
  5. Scan the QR code displayed by Bybit or enter the setup key manually.
  6. Write down the Recovery Key Phrase and store it securely.
  7. Enter the current 6-digit authenticator code.

VERIFY: Return to Bybit Security and confirm that Google Authenticator is shown as enabled.

Protect your account with a passkey

Passkeys provide another strong authentication method using a device's biometric verification, PIN or compatible security key.

Click to see protection steps

Step-by-step

  1. Open Account → Security.
  2. Find the Passkey section.
  3. Select the option to Add a Passkey.
  4. Follow the security prompt on your device.
  5. Complete verification using your fingerprint, face recognition, device PIN or security key.
  6. Give the passkey a recognizable name if Bybit provides that option.

VERIFY: Confirm that every passkey listed on Bybit belongs to a device or security key that you intentionally control.

Review your passkeys

An unfamiliar passkey can represent an unauthorized access path to your account.

Click to see protection steps

Step-by-step

  1. Open Account → Security → Passkeys.
  2. Review every passkey associated with your account.
  3. Identify the device associated with each passkey.
  4. Remove any passkey you do not recognize.
  5. If you discover an unauthorized passkey, change your password and review your other security settings.

VERIFY: Every passkey listed should correspond to a device or security key that you personally control.

Enable Secure Transaction Approval

Bybit's Secure Transaction Approval can require transactions initiated from the website or another device to be approved on your designated primary phone.

Click to see protection steps

Step-by-step

  1. Confirm that you have completed the required identity verification and authentication methods.
  2. Open the Bybit mobile app.
  3. Tap your profile icon and open Settings → Security.
  4. Find Secure Transaction Approval.
  5. Tap Activate Now.
  6. Complete the required security verification.
  7. Your phone will become the designated primary device.

VERIFY: Confirm that Secure Transaction Approval shows your intended phone as the primary device.

Approve transactions only after checking the details

Secure Transaction Approval is only useful if you carefully inspect the request before approving it.

Click to see protection steps

Step-by-step

  1. When a transaction is initiated from a website or secondary device, wait for the verification request on your primary phone.
  2. Review the transaction details.
  3. Check the Request ID.
  4. Confirm that you personally initiated the transaction.
  5. Tap Approve only when everything matches.
  6. Tap Reject if you do not recognize the transaction.

VERIFY: Never approve a Secure Transaction Approval request simply because it appeared on your phone. Approve only transactions you independently recognize.

Enable withdrawal address whitelist

Bybit's Withdrawal Address Whitelist allows you to verify and restrict withdrawals to approved wallet addresses.

Click to see protection steps

Step-by-step

  1. Open Account → Security → Withdrawal Security.
  2. Open the Withdrawal Address Book.
  3. Add the wallet address you intend to use.
  4. Enter the correct coin, blockchain and wallet address.
  5. Complete the required email and 2FA verification.
  6. Activate the Withdrawal Address Whitelist.
  7. Review the saved addresses regularly.

VERIFY: Confirm that every whitelisted address belongs to a destination you independently verified and intentionally approved.

Use address-book-only withdrawals

Bybit's Withdraw via Address Book function can prevent a user from entering a brand-new address during the withdrawal process.

Click to see protection steps

Step-by-step

  1. Open the Withdrawal Security settings.
  2. Find Withdraw via Address Book.
  3. Enable the function.
  4. Complete the required 2FA verification.
  5. From that point, withdrawals can be limited to addresses already registered in your withdrawal address book.

VERIFY: Confirm that a withdrawal attempt cannot simply use an unregistered new address.

Enable the 24-hour new-address withdrawal lock

Bybit can impose a withdrawal ban on newly added wallet addresses for 24 hours, creating a delay that can help prevent immediate unauthorized withdrawals.

Click to see protection steps

Step-by-step

  1. Open Account → Security → Withdrawal Security.
  2. Find New Address Withdrawal Lock.
  3. Enable the 24-Hour Withdrawal Lock.
  4. Complete the required 2FA verification.
  5. Understand that newly added addresses may not be immediately available for withdrawal.
  6. Keep this protection enabled unless you have a specific reason to change it.

VERIFY: Confirm that the 24-hour new-address lock is enabled and understand that it intentionally delays withdrawals to newly added addresses.

Set sensible withdrawal limits

Bybit allows users to configure crypto daily and monthly withdrawal limits. A sensible limit can reduce the impact of an unauthorized account takeover.

Click to see protection steps

Step-by-step

  1. Open your Withdrawal Security settings.
  2. Find Crypto Withdrawal Limits.
  3. Consider how much you realistically need to withdraw in a normal day or month.
  4. Set a limit that provides useful protection without preventing your legitimate activity.
  5. Complete the required security verification.
  6. Review the limits periodically as your usage changes.

VERIFY: Confirm that your withdrawal limits are appropriate for your normal activity and have been successfully applied.

Verify every withdrawal

A crypto withdrawal can be irreversible. Always verify the destination, asset, network, amount and any required memo or tag.

Click to see protection steps

Step-by-step

  1. Confirm the recipient address from a trusted source.
  2. Verify the asset you are sending.
  3. Verify the blockchain/network.
  4. Confirm that the receiving wallet or exchange supports that exact network.
  5. Check the amount.
  6. Check whether the destination requires a memo or tag.
  7. Review every security prompt before confirming.
  8. For a high-value transfer, consider a small test transaction first when practical.

VERIFY: Before confirming, independently verify the recipient, asset, network, amount and any required memo or tag.

Understand the 24-hour security restriction

Bybit currently applies a 24-hour withdrawal restriction after several sensitive account-security changes.

Click to see protection steps

Step-by-step

  1. Know that changing or resetting your account password can trigger a 24-hour restriction.
  2. Changing your registered mobile number can also trigger the restriction.
  3. Changing or disabling your email address can trigger the restriction.
  4. Activating or disabling the New Address Withdrawal Lock can trigger it.
  5. Disabling or resetting Google Authenticator can trigger it.
  6. Changing or disabling your Fund Password can trigger it.
  7. Removing your Passkeys can trigger it.

VERIFY: If a 24-hour restriction appears after a security change you intentionally made, do not repeatedly change settings. Wait for the restriction to expire.

Protect your email and phone

The email address and phone number connected to Bybit form part of your account-security chain.

Click to see protection steps

Step-by-step

  1. Confirm that the email address linked to Bybit is still yours.
  2. Protect that email account with a unique password and MFA.
  3. Confirm that your linked phone number is current.
  4. Review the email account's active sessions and recovery methods.
  5. Never give a Bybit verification code to another person.
  6. Treat unexpected password-reset or verification messages as possible warning signs.

VERIFY: Confirm that the email and phone channels connected to Bybit are secure and under your control.

Protect yourself from phishing and fake support

Fake exchange websites, support agents and urgent security messages can be used to steal credentials or manipulate withdrawals.

Click to see protection steps

Step-by-step

  1. Access Bybit through the official website or app.
  2. Do not trust a Bybit link simply because it arrived through email, SMS, Telegram, WhatsApp, Discord or social media.
  3. Check the browser address bar before signing in.
  4. Never give your password, 2FA code, passkey approval or private key to someone claiming to be Bybit Support.
  5. Never transfer funds to a supposed secure, recovery or risk-control wallet.
  6. If someone pressures you to act immediately, stop and independently open Bybit yourself.

VERIFY: Confirm the Bybit channel independently before entering credentials or approving a transaction.

Protect the device you use for Bybit

Strong exchange settings cannot fully protect an account if the device used to access it is compromised.

Click to see protection steps

Step-by-step

  1. Keep your phone or computer's operating system updated.
  2. Install Bybit only from an official source.
  3. Use a strong screen lock.
  4. Remove suspicious applications and browser extensions.
  5. Be cautious with software requesting unnecessary accessibility or device-control permissions.
  6. Avoid sensitive account recovery actions on a device you suspect may be compromised.

VERIFY: Confirm that the device used for Bybit is updated, locked and free from suspicious software.

Secure the account after suspicious activity

An unfamiliar login, passkey, transaction approval, withdrawal address or security change should be treated as a possible compromise.

Click to see protection steps

Step-by-step

  1. Stop unnecessary trading and withdrawals.
  2. Move to a trusted device if possible.
  3. Change your Bybit password.
  4. Review your Google Authenticator settings.
  5. Review and remove unfamiliar passkeys.
  6. Review your Secure Transaction Approval primary device and approval history.
  7. Review your withdrawal address book.
  8. Review your withdrawal limits.
  9. Preserve suspicious transaction hashes, addresses and other evidence.
  10. Use only official Bybit support for assistance.

VERIFY: Do not resume normal activity until you have identified and addressed the source of the suspicious access.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Bybit security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts