A fifteen-minute Bybit account security review you can repeat every quarter

Security settings decay quietly. Phones are replaced, email passwords are reused, and a whitelist you meant to turn on never was. A short review every few months catches most of this before it matters. The Bybit Account and Security page lists everything in one place, so the review is mostly a matter of going down the list and asking one question at each line: is this still how I want it? Here is the order that works best.

Start with email and password

Your email is the master key, because password resets go there. Before opening Bybit, make sure the email account has its own strong password and two-factor authentication. Then, in Bybit, open Account and Security and change the login password if it is old or used anywhere else. A password manager makes long unique passwords practical.

Check the two-factor method and add a passkey

Confirm that Google Authenticator or another authenticator app is bound, and that you know where its setup key is stored. SMS codes are better than nothing but can be hijacked through SIM swaps, so treat them as a backup only. If the passkey option appears in the security list, add one; it signs you in with your phone's lock and does not work on fake domains.

Anti-phishing code and withdrawal whitelist

Set an anti-phishing code if you have not, so genuine Bybit emails can be recognised. Then open withdrawal address management, enable the whitelist and remove addresses you no longer use. Each remaining entry should have a label you understand. If you find an address you do not recognise, treat it as a possible compromise: change your password and contact support from inside the app.

Devices, sessions and API keys

Review the device list and login history. Remove phones and browsers you no longer use and note any login from a place or time you cannot explain. Finally, open the API page and delete keys for tools you have stopped using. Write the review date in your notes and set a reminder for the next one.

What to do if something looks wrong

If the review turns up a login you cannot explain, a device you never used or a whitelist address you did not add, act in this order: change the email password, change the Bybit password, reset the authenticator if you suspect it was exposed, and remove unknown devices. Then contact support through the in-app chat with the times and details you noted. Do not wait to see whether it happens again.

Risk boundary: Kenya Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Confirm the email account behind Bybit has its own strong password and two-factor login
• Enable the withdrawal whitelist and delete addresses you no longer use or recognise
• Remove old devices and unused API keys, then set a reminder for the next review