Bybit is a large crypto exchange with its own wallet and a Web3 section where people browse decentralised apps. That surface is useful — and heavily imitated. Phishing sites and chat pitches borrow the logo, talk about airdrops, IDO pools, or “Web3 activation”, and push a Connect Wallet button. Bybit’s own help material is clear: it will not ask you to send assets to an unknown address or hand over a recovery phrase, and it is not liable for losses from third-party dApps you choose to use.
The trap is usually an approval, not a password theft. You think you are “just connecting”. The signature window may grant a contract unlimited spend on USDT, NFTs, or other tokens. After that, funds can leave without a second manual transfer. A parallel script claims Bybit is “testing a token” or needs you to move coins to an “official” address for a reward — sometimes with a tiny return first. Fake “support” then follows with AML fees, frozen wallets, or remote-access “fixes”.
Threat trackers have catalogued Bybit-themed domains and drainers that appear after high-profile news, hoping panic clicks win. Open dApps only from addresses you typed or bookmarked. Read every permission. Reject unlimited approvals from strangers. If you already signed something odd, revoke token allowances from a clean device, move what remains to a new wallet, and ignore anyone who cold-messages a paid recovery.
The exchange brand on a landing page is not a safety seal. Your signature is.
If you have lost money or signed a hostile approval, start at Get help. Treat cold “refund” offers as fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.