On this page (10)
Bybit started as a derivatives exchange and grew into one of the largest crypto platforms in the world. In Kenya it is best known as the “other” P2P app: when Binance prices are wide or a seller is slow, traders check Bybit. Its search interest in Kenya is second only to Binance. The headline risk is not Kenyan at all — it is the February 2025 hack, and how Bybit handled it.
Verdict in one minute
Our score rests on five things: how shillings get in and out, real costs, licences and track record, security and proof of reserves, and how smooth verification is with a Kenyan ID. The method is on our editorial policy page.
Bybit scores 8.3 out of 10, third in our Kenya ranking. It has the capital and the market depth of a top-tier exchange and a real MiCA licence in the EU. It loses points because its fee pages did not load for us, so we could not confirm current fee rates at source, because the 2025 hack showed weaknesses in how it secured cold-wallet transfers, and because the app nudges beginners towards leveraged futures.
What works for Kenyans
- P2P marketplace where Kenyan users trade USDT for KES with M-Pesa
- MiCA authorisation for Bybit EU GmbH from Austria's FMA (decision dated 28 May 2025)
- UAE SCA licence for a virtual-asset platform (announced 10 October 2025)
- Refilled about 447,000 ETH within roughly 72 hours after the 2025 hack
What does not
- About $1.4–1.5bn in ETH stolen on 21 February 2025, attributed by the FBI to North Korea
- No Kenyan VASP licence; only a provisional licence from Dubai's VARA
- Bybit's fee pages did not load for our check, so current spot and P2P fee rates are not confirmed at source
- App home screen pushes futures with leverage, which can liquidate a deposit fast
Can you use Bybit in Kenya?
Yes. Bybit’s service agreement lists restricted jurisdictions — the examples we could see include the United States, mainland China, Hong Kong, Singapore, Canada, North Korea, Cuba and Iran. Kenya was not among them. We could not load the full current list from Bybit’s help centre, so if you are unsure, check the Service Restricted Countries page before you deposit.
Bybit’s regulated entities are outside Africa. Bybit EU GmbH serves the European Economic Area under MiCA; a separate entity holds a UAE licence. Kenyan users are served by Bybit’s global platform, which is not licensed in Kenya. That is the same position as every other exchange we review — see our regulation guide for what the VASP Act changes.
Depositing KES: M-Pesa, P2P, bank, card
| Route | Status for Kenyans | How it works |
|---|---|---|
| P2P with M-Pesa | Yes — “M-Pesa Kenya (Safaricom)” and “M-Pesa Paybill” KES ads | Pay the seller’s M-Pesa line; USDT released from escrow |
| P2P with bank transfer | Depends on each advertiser | Seller lists the banks they accept |
| Direct M-Pesa deposit | Not offered | — |
| Card purchase | Not confirmed for Kenyan cards | Check Buy Crypto in the app |
| Crypto deposit | Yes | Send USDT from another exchange or wallet |
The practical route is the same as on Binance. You open P2P, choose Buy → USDT → KES, filter for M-Pesa and pay a seller. Bybit’s public P2P feed showed around sixty live USDT/KES ads when we last checked, paid mainly by M-Pesa Kenya (Safaricom), M-Pesa Paybill and I&M Bank transfers. Ads and methods change through the day, so filter by M-Pesa before you place an order.
The P2P rules that keep you safe are universal: pay only from an M-Pesa line in your own name, pay only the number shown inside the order, and never move the chat to WhatsApp. Our P2P guide and M-Pesa buying guide explain each rule.
Rather skip P2P altogether?
With a working bank card you can buy BTC or USDT directly on our top-rated exchange — no seller, no escrow, no reversal risk.
Fees in real numbers
Bybit’s fee page timed out every time we tried to load it, so we are not printing numbers we could not check. Third-party reviews widely quote a 0.10% spot fee for non-VIP accounts; treat that as a guide, not a fact, and look at the fee tier in Account → Fee Rates before you trade.
| Cost | What we could confirm | Where to check |
|---|---|---|
| Spot trading fee | Not confirmed at source (0.10% widely quoted) | Account → Fee Rates |
| P2P fee | Not confirmed at source | Order confirmation screen |
| Seller markup | Set by each advertiser | Compare with live rate |
| M-Pesa Send Money fee | Safaricom tariff (e.g. KSh 90 on KSh 7,501–10,000) | Our M-Pesa calculator |
| USDT withdrawal fee | Varies by network and over time | Withdraw screen |
On any P2P trade, the seller’s MarkupExtra margin added on top of the market rate by a broker or P2P seller. It is a fee even when the app says "zero fees". Glossary and the M-Pesa fee usually cost more than the exchange fee. Our M-Pesa charges calculator adds them up for your amount. For withdrawals, pick a cheap Network (chain)The blockchain a transfer travels on. USDT exists on TRON (TRC20), BNB Smart Chain (BEP20), Ethereum (ERC20) and others — sender and receiver must pick the same one. Glossary such as TRC20The token standard on the TRON blockchain. USDT-TRC20 is popular in Kenya because transfers are cheap and fast, but you need a little TRX for fees. Glossary or BEP20The token standard on BNB Smart Chain. Fees are paid in BNB and are usually a few US cents. Glossary and check the fee on screen — it changes.
KYC: which documents work
Bybit asks for a government-issued ID and a selfie for identity verification, with accepted document types depending on the country. A Kenyan National ID (or Maisha Namba card) or passport is the obvious choice, but we could not load Bybit’s KYC help pages to confirm the exact Kenyan options and limits, so follow the prompts in the app.
The rule that matters for M-Pesa trades: the name on your M-Pesa line must match your verified Bybit name. A mismatch means sellers can refuse to release, and payments from someone else’s line are treated as Third-party paymentPaying from an M-Pesa line or bank account that is not in your own name. P2P rules forbid it and it is a common cause of frozen accounts. Glossary on every major P2P platform.
Security and track record
On 21 February 2025, attackers took control of a Bybit Ethereum cold wallet during a routine transfer to a warm wallet and moved out about 401,000 ETH — roughly $1.4bn by Bybit’s estimate, and about $1.5bn according to the FBI. Investigators traced the entry point to compromised developer infrastructure at Safe{Wallet}, the multi-signature wallet service Bybit used. The FBI attributed the theft to North Korea, in activity it calls “TraderTraitor”.
- ETH stolen
- ~401,00021 Feb 2025, per Bybit
- Value (FBI)
- ~$1.5bnlargest crypto theft on record
- ETH refilled
- ~447,000within about 72 hours
What Bybit did next is the reason it still ranks third. CEO Ben Zhou said on the day that Bybit was solvent and client assets were fully backed. Within about three days Bybit had rebuilt its ETH balance through emergency loans and large deposits from trading firms, and a Proof of reservesA report in which an exchange shows it holds customer assets 1:1. Useful, but it does not prove the exchange has no hidden debts. Glossary audit by Hacken found its major assets above 100% collateralisation. Customers did not take the loss — but the episode shows that “cold wallet” does not mean “untouchable”.
For your own account: use an authenticator app or passkey for 2FATwo-factor authentication: a second code from an app like Google Authenticator. Safer than SMS codes, which SIM-swap fraudsters can intercept. Glossary, set an anti-phishing code, and whitelist your withdrawal addresses.
Licences and regulation
| Jurisdiction | Status we verified |
|---|---|
| EU (Austria, MiCA) | Bybit EU GmbH authorised by the FMA, decision dated 28 May 2025 |
| UAE (SCA) | Virtual-asset platform licence, announced 10 October 2025 |
| Dubai (VARA) | Provisional licence only |
| Kenya (CMA / CBK) | No licence found |
Kenya’s VASP Act 2025 requires exchanges serving Kenyans to be licensed by the CMA. The transition period for existing operators ended on 4 November 2026 and we found no public register of licensed providers. Keep records of every trade: KRA’s crypto tax rules apply to gains whichever platform you use.
Step by step: first purchase
- Register and verify
Sign up with your email or Kenyan phone number, then complete identity verification with your ID and a selfie. Use the name on your M-Pesa line.
- Open P2P and filter
Tap Buy Crypto → P2P Trading, choose Buy → USDT → KES, then filter for M-Pesa and type your amount.
- Choose an advertiser
Pick a verified advertiser with hundreds of orders and a completion rate above 95%. Read the ad terms and the Payment windowThe time limit (often 15 minutes) a P2P buyer has to send M-Pesa and mark the order as paid before it is cancelled. Glossary.
- Pay from your own M-Pesa
Send the exact amount using the details shown in the order. Confirm the recipient name in the M-Pesa prompt before entering your PIN.
- Mark as paid and wait for release
Mark the order as paid. If the seller does not release in time, open an Appeal (dispute)Asking the P2P platform's support team to step in when a trade goes wrong. They review chat, receipts and M-Pesa messages. Glossary with your M-Pesa SMS — do not cancel a paid order.
Withdrawing to M-Pesa
- Move USDT to the Funding account
P2P sells use your Funding account. Transfer from the Unified Trading account if needed.
- Sell USDT for KES on P2P
Choose Sell → USDT → KES, filter for M-Pesa and pick a buyer with a long, clean history.
- Confirm the money in your balance
Open the M-Pesa app and check the balance and the sender’s name. Fake SMS messages are a common trick — read our reversal scams guide.
- Release and record
Release the USDT and keep the order number with the M-Pesa code. If KES buyers on Bybit are thin, send the USDT to another P2P exchange instead — see our cash-out guide.
After the hack, Bybit is the most dangerous exchange to use.
The hack showed a real weakness, and it is fair to weigh it. But Bybit covered the loss without touching client balances, and its reserves were audited afterwards. Exchanges that hide incidents or publish no reserves at all deserve more suspicion, not less.
Keep a second, simpler account
Buy BTC or USDT with your card on a long-running exchange and keep your P2P account for M-Pesa trades only.
Alternatives
- CEX.IO review — our top pick: buy with a bank card, no P2P counterparty.
- Binance review — the deepest KES P2P market, with the April 2026 freezes to weigh.
- OKX review — monthly proof of reserves and a built-in self-custody wallet.
- NoOnes review, Bitget review, MEXC review and KuCoin review.
Compare all eight in our best crypto exchanges in Kenya ranking.
Frequently asked questions
Is Bybit available in Kenya?
Can I use M-Pesa on Bybit?
Did Bybit users lose money in the 2025 hack?
How do I withdraw from Bybit to M-Pesa?
Is Bybit licensed in Kenya?
Is Bybit good for beginners in Kenya?
- Bybit — Service restricted countries
- FBI IC3 — North Korea responsible for $1.5 billion Bybit hack (PSA, 26 Feb 2025)
- TechCrunch — Bybit says it was hacked and lost around $1.4 billion
- CNBC — Bybit replenished reserves after record hack
- Elliptic — The Bybit hack, the largest in history
- FMA Austria — Granting of authorisation to Bybit EU GmbH
- The National — Bybit receives UAE SCA licence (10 Oct 2025)





