How to create a Bybit account, step by step

Updated 2026-08-28

Registration itself takes a few minutes. The parts worth slowing down for are the two before it and the three after it, because those are what decide whether the account still works in six months.

Before you start: two checks

Check availability. Bybit publishes a list of service-restricted jurisdictions — currently naming the United States, the Chinese Mainland, Hong Kong, Singapore, Canada, North Korea, Cuba, Iran, Uzbekistan, Russian-controlled regions of Ukraine, Sevastopol, Sudan and Syria. There are also separate arrangements in Europe and product-level limits in some markets. Work through availability by country before you create anything. An account opened from a place that is not served is a problem waiting to appear at the moment you try to withdraw.

Check you are on the real site. Type the address into the browser yourself rather than clicking a search result or a link in a message. Read the address character by character. The official site and security page explains the method properly, and it is the single highest-value habit in this whole guide.

The registration itself

You will be asked for an email address or a phone number and a password, then to confirm with a code sent to whichever you used.

Use an email address you control directly and that is itself protected with strong authentication. The email account is the recovery route for everything else — if an attacker owns your inbox, the exchange account follows shortly.

Use a password that exists nowhere else. Reused passwords are attacked automatically at scale, using credentials leaked from unrelated sites. A password manager removes the excuse for reuse.

Register under your own legal name, spelled exactly as it appears on the identity document you intend to verify with. Nicknames, transliteration variants and missing middle names are a routine cause of rejected verification later.

The three things to do immediately after

Turn on app-based two-factor authentication

Not SMS. Mobile numbers get taken over through the carrier — social engineering, a duplicate SIM, an insider — and once someone receives your codes, your password is the only thing left. An authenticator app on your phone is not vulnerable to that.

When you enable it, the platform shows backup codes. Save them somewhere offline. People lose phones, and an account with two-factor enabled and no backup codes is a slow, painful recovery process at best.

Set a withdrawal address whitelist

If you expect to withdraw to the same wallet repeatedly, restricting withdrawals to approved addresses converts a full account compromise into a partial one. It is the difference between an attacker taking everything and an attacker being stuck.

Complete verification early

Do it before you have money on the platform, not after. Verification while the account is empty is administration; verification while a balance is stuck is stress. The verification guide covers what is asked for and why submissions get rejected.

What not to do

Do not let anyone help you set it up remotely. Screen-sharing with a "manager", "analyst" or "support agent" who found you first is the standard opening move of investment fraud. Legitimate support never initiates contact and never needs to see your screen.

Do not register an account for someone else, or let someone else use yours. It breaches the terms and, in the fraud patterns that target new users, it is usually the point of the exercise.

Do not skip the security setup because you intend to deposit only a small amount. Small accounts get compromised at the same rate; they simply lose less. The habits are what you are building here.

Do not store the password in the same place as the two-factor backup codes. That defeats the point of having two factors.

If you register through someone's referral link, the exchange records that your account came from that partner and pays them a share of the fees it collects from your trading. It does not change your fee tier and it costs you nothing. It also cannot be added later, in most cases — attribution happens at sign-up. What it is not is a discount, a bonus guarantee or a route around any of the rules above. The mechanics are in referral links explained, including how to judge the sites that hand them out.

When registration goes wrong

The confirmation code never arrives. Check spam, confirm you typed the address correctly, and wait before requesting another — repeated requests sometimes trigger a cooldown that makes things slower, not faster. If you used a phone number, roaming and carrier filtering are common culprits.

The email is already registered. Either you have an account you forgot, or someone else registered using your address. Use the account recovery flow rather than creating a second identity, and secure the email account itself.

Registration is refused. Usually this means the location is not served. That is a real answer, not an obstacle to route around.

After the account exists

The next steps are verification, then funding the account. Before you deposit anything, it is worth reading how to judge exchange safety — specifically the part about how much of your money belongs on any exchange at any moment. The short version: less than most people keep there.

Frequently asked questions

Do I have to verify my identity to open an account?
You can normally create an account first, but meaningful use — funding it, trading and withdrawing — depends on verification. Treat it as part of registration rather than an optional extra, and complete it before you deposit anything.
Can I register if my country is on the restricted list?
No, and attempting to work around it breaches the platform's terms. The usual outcome is a frozen balance during a later review, not a clever workaround. Check availability before you start.
Should I use SMS or an authenticator app for two-factor?
An authenticator app. Phone numbers can be taken over through the mobile carrier, and once someone controls your number an SMS code protects nobody. Save the backup codes offline when you set it up.
What name should I register under?
Your own legal name, exactly as it appears on the document you will verify with. A mismatch between the account name and the document is one of the most common reasons verification is rejected.
Can somebody else open or manage the account for me?
No. Accounts are personal, and letting another person operate yours breaches the terms and is a common shape of investment fraud. Nobody legitimate needs access to your account.

We earn a commission if you open an account through our link. It does not change what you pay, and it does not decide what we write.

Open an account on Bybit

Keep reading