Someone points you to a sleek dark site that wears the Bybit logo, talks about unlimited copy trading and asks you to register, fund a wallet and paste an API key. One domain that appears in victim reports is api-center.info. A quick open-web check does not show Bybit claiming that site as an official product. Independent write-ups describe a young domain, thin corporate detail and the usual dashboard that shows trades closing in profit for a fortnight — until withdrawal time.
When the user asks to disconnect strategies and take the capital out, “support” may cancel the request and invent a condition: make a fresh turnover of hundreds of USDT between wallets, then try again. Others are steered to a Telegram “compliance” handle. That is not how a real exchange releases your money. Official Bybit copy trading lives inside Bybit’s own app and website; it does not require a random third-party portal that looks similar and then bills you to exit. Related approval-drain tricks use the same “connect for copy trading” story on other domains — the mechanic is the same even when the brand sticker changes.
If you already created an API key for such a site, revoke it immediately in the exchange’s official API settings, change passwords and two-factor codes, and stop paying for turnover, tax or unlock fees. Keep screenshots of the domain, chat and any transaction hashes. Report through Get help. If a helpful stranger now offers to claw the money back for an upfront crypto payment, treat that as a second scam and read Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.