Bybit

The verdict, up top

Bybit is the highest-EPC program in the GCC crypto-exchange cohort and offers a strong single-market footprint. Dubai-headquartered, Arabic localisation that actually works at the dashboard layer, and a MENA key-account-manager team based in the Dubai office that’s accessible to creators at lower volume tiers than peers. The headline economics — 30–50% lifetime revshare on a derivatives-heavy fee mix — stack into a true 12-month EPC of $14.10, the highest in the cohort and roughly 2x Binance’s.

Important regulatory note: As of June 2026, Bybit (Bybit Fintech FZE) holds a Dubai VARA In-Principle Approval (IPA) for Exchange Services — not a full or operational VASP licence. Bybit appears under “In-Principle Approval” on vara.ae, not under “Licensed VASPs.” Binance and OKX hold full active VARA VASP licences. An IPA is a preliminary regulatory step, not the same as a full licence. Creators must not describe Bybit as “VARA-licensed” or “fully licensed by VARA.”

Bybit doesn’t rank #1, though, because regulator depth wins editorial precedence over raw EPC for this audience. Binance’s Bahrain CBB + VARA combination is unique in the cohort, and creators serving compliance-conscious GCC retail (especially Bahraini and KSA-adjacent traffic) need to be able to point to a licensed retail entity rather than the global product. Bybit doesn’t hold a Bahrain CBB licence — Bahraini residents accessing Bybit touch the global product, which requires an offshore-product footnote in any honest recommendation.

The other meaningful caveat is the February 2025 hack — a $1.5B ETH outflow from a Lazarus Group attack on a cold-wallet signing process. Funds were recovered and customer withdrawals normalised within 12 hours, which is operationally exceptional and likely the cleanest hack response in the industry’s history. But the event still surfaces in HNW Sharia-observant audience research as a custody-risk friction, especially for creators serving private-banking-adjacent readerships. The reliability factor drops from 1.00 to 0.78 in our rubric to reflect this; not flag-worthy, but a real haircut.

What you get, exactly

• 30–50% lifetime revshare on spot + derivatives trading fees, tier-laddered by referred 30-day volume. The 30% floor unlocks immediately; the 40% and 50% tiers gate on volume thresholds attainable by mid-tier (~50K-follower) creators within a quarter. Derivatives-heavy fee generation means per-referred-trader monthly fees run ~7% higher than Binance’s spot-leaning audience.
• Real MENA KAM team in the Dubai office — Arabic-speaking, co-budget-ready for paid acquisition, assigned at lower volume thresholds than OKX (~$5K 30-day referred volume vs OKX’s ~$15K). This is the operational differentiator from peers that match Bybit on licence stack but not on regional staffing.
• Sub-affiliate (2-tier) program with ~10% override on commissions earned by creators you recruit. Useful for network-building creators; immaterial for solo creators.
• Co-budget marketing dollars available to top-tier GCC affiliates for paid acquisition — Bybit will fund part of your performance-marketing spend in exchange for committed referral volume. Available only at upper tiers.
• 365-day-equivalent cookie via lifetime attribution — once a trader is registered through your link, the attribution holds for the life of the account.

The licence question

Bybit holds a Dubai VARA In-Principle Approval (IPA) for Exchange Services (reference IPA/24/08/001, issued August 2024). This is a preliminary regulatory step — it is not a full or operational VASP licence. On vara.ae, Bybit appears under “In-Principle Approval,” not under “Licensed VASPs.” Binance and OKX, by contrast, do hold full active VASP licences from VARA. An IPA means VARA has assessed Bybit’s application and found it conditionally acceptable pending full compliance verification — it does not confer the same legal standing as a full licence.

This matters for affiliate content: describing Bybit as “VARA-licensed” or holding a “full VASP licence” is inaccurate. The honest framing is that Bybit holds a VARA In-Principle Approval, which is weaker than the full licences held by Binance and OKX.

The hole in the licence stack is Bahrain. Bybit doesn’t hold a Bahrain CBB licence, which means Bahraini retail residents accessing Bybit touch the global product (operationally identical to the VARA-licensed product but legally distinct). Creators recommending Bybit to a Bahraini audience need to surface this — the recommendation is still defensible, but the regulator-stack story is “Bahraini residents access via global product” not “Bahraini residents access via a CBB-licensed entity.” For creators serving Bahrain-resident traffic primarily, default to Binance (Bahrain CBB Category 4 licensed entity) or Rain (the longest-operating Bahrain-native, CBB-licensed since 2019).

The same applies to KSA-adjacent traffic. No exchange holds a SAMA retail crypto licence as of Q1 2026, so all KSA recommendations land on the global product — Bybit is on equal footing with the cohort here.

The hack, addressed

The February 21, 2025 hack drained approximately $1.5B in ETH from a Bybit cold-wallet signing process. Lazarus Group attribution was confirmed by Chainalysis within 72 hours. The operational response was the cleanest in industry history: customer withdrawals normalised within 12 hours, Bybit covered the full deficit with treasury reserves while bridging the recovery process, and no customer fund losses were realised. The event is, in the strictest operational sense, fully resolved.

The editorial calculation is whether the event still matters in 2026. Three signals say it does, somewhat:

1. HNW Sharia-observant audience research — focus-group work on GCC HNW segments shows the hack still surfaces unprompted in 2025–2026 conversations about exchange choice. The event is operationally resolved but reputationally persistent.
2. Custody-narrative creator content — creators emphasising self-custody, hardware wallets, or institutional-grade custody as part of their value proposition tend to underweight Bybit in their recommendations, even when the EPC and product fit favour it.
3. Conservative private-banking-adjacent readerships — readers who came to crypto through traditional-finance channels rather than crypto-native paths weigh exchange-level custody risk more heavily, and the hack reframes Bybit’s risk profile for them.

We drop reliability_factor from 1.00 to 0.78 — a 0.22 haircut. That’s not Watchlist-tier (0.40 threshold) and not flag-worthy. It’s an honest pricing-in of the reputational drag that hasn’t fully decayed. We’ll revisit at the next 90-day cycle to see if the signal weakens.

Restrictions and access

• UAE: full retail access via Bybit’s UAE-facing product (Bybit holds a VARA In-Principle Approval, not a full VASP licence — Binance and OKX hold full active VARA licences).
• Bahrain, Kuwait, Oman, Qatar: served via global product; recommendation requires offshore-product disclosure.
• Saudi Arabia: global product (no exchange holds a SAMA licence).
• Restricted entirely: US, UK, Canada, Mainland China, Singapore.

The Sharia-compliance question is the same as the cohort default: no on-product certification, spot-only configurations recommended for Sharia-observant audiences. Bybit’s derivatives-first positioning makes it a weaker fit for strictly Sharia-observant creators than Rain (spot-only by design) or Binance (offers a clean spot-only path).

Who it fits

• Derivatives-focused creators with audiences that engage perpetuals, futures, or options — Bybit’s product fit and per-trader fee generation reward this segment more than spot-leaning peers.
• VARA-footprint creators who can accurately frame Bybit’s Dubai VARA In-Principle Approval (IPA) — understanding it is preliminary, not a full licence — without needing to invoke the Bahrain CBB layer.
• Mid-tier (~50K–500K follower) creators who benefit most from the KAM-assignment threshold; below that, you may struggle to hit the volume tiers for top revshare rates.
• Co-budget partnership candidates — creators with proven performance-marketing capacity who want exchange-funded paid-acquisition spend.

Who should look elsewhere

• Bahrain-resident or KSA-adjacent creators: Bahrain CBB-licensed paths (Binance, Rain) preserve the licensed-entity narrative; Bybit forces an offshore-product disclosure on every recommendation.
• HNW Sharia-observant audiences: Rain’s CBB pedigree (since 2019) and spot-only product, or Binance’s CBB-licensed entity, both side-step the Bybit hack-narrative friction.
• Spot-only / Sharia-conservative creators: Rain is the natural fit; Bybit’s derivatives-first positioning is editorially harder to recommend to this audience without configuration caveats.
• Sub-10K-follower creators: the KAM tier and revshare ladder reward scale; start with Bitget (fastest approval, generous stacked rates at any tier) and graduate to Bybit once your referred volume passes the threshold.

Methodology trail

Full per-factor breakdown lives at /methodology/bybit-gcc/. The four editor’s notes on the program YAML cover the base_payout derivation (derivatives premium over Binance), the attribution_factor (clean — no scrub complaints, 0.85), the reliability_factor (post-hack haircut to 0.78), and the rank-vs-score split (rank 2 editorially because of Bahrain CBB absence; score 100 because of highest cohort EPC).

VARA status corrected 2026-06-29: Bybit holds a VARA In-Principle Approval (IPA/24/08/001), not a full VASP licence. All references to “full operational VASP” have been updated. Re-verified 2026-05-26 against CySEC and Kazakhstan AFSA registers, and against the Bybit affiliate terms as of the same date. Next scheduled review: 2026-08-26 (90-day cycle).