Bybit wins Dubai spot trading license but still cannot offer derivatives, the product it is best known for

Bybit has received a licence from Dubai’s Virtual Assets Regulatory Authority (VARA) to run a spot trading exchange, but the permit does not cover derivatives, the product behind much of its global business, the company said on 22 October 2026.

The company presented the approval as part of its broader approach to operating within regulatory frameworks. Bybit described the license as another example of its “continued focus on working with regulators and securing the appropriate permissions.”

The VARA license adds to a series of regulatory developments across Bybit’s international business. Its ambitions in Dubai, however, extend beyond the latest approval, with the company identifying derivatives as an area it hopes to introduce through a separate regulatory process.

That distinction is central to the announcement: the exchange has secured a license, but its stated plans for additional products depend on obtaining the necessary permissions. The supplied account does not specify the full scope of activities covered by the latest authorization.

Regulatory progress follows February 2025 exchange hack

The VARA license comes against the backdrop of one of the most significant security incidents in cryptocurrency history. In February 2025, hackers stole nearly $1.5 billion worth of ETH and ETH-based tokens from Bybit in what the supplied report described as a record-setting theft.

The U.S. Federal Bureau of Investigation attributed the attack to North Korea’s Lazarus Group. Bybit said the attackers had compromised a developer’s machine at SafeWallet, the provider hosting its cold wallet, enabling them to disguise a malicious transaction.

The immediate fallout extended beyond the assets stolen. Customers withdrew more than $4 billion in additional funds from the exchange in the days after the attack, underscoring the scale of the challenge facing the business.

Bybit subsequently recorded several regulatory milestones. It obtained a license under the European Union’s Markets in Crypto-Assets Regulation in May 2025, followed by an SCA license that October.

The VARA license now forms part of that wider regulatory record. These approvals establish progress in securing permissions, although the supplied account does not demonstrate how far they have restored customer confidence following the breach.

Other developments involved businesses operating in Austria and Indonesia. In August, Bybit Payments GmbH received an electronic money institution license from Austria’s Financial Market Authority.

In Indonesia, Bybit acquired a majority stake in the operator of local exchange NOBI in April. The business was renamed Bybit Indonesia and began operating under the supervision of the country’s Financial Services Authority, known as OJK, in July.

VARA license sets stage for derivatives ambitions

Bybit Chief Legal and Compliance Officer Peter Loo welcomed the Dubai approval while emphasizing regulatory oversight, risk management and user protection.

“Securing this license is a significant step forward for Bybit. We have great respect for VARA’s work in establishing a clear and robust framework for virtual assets. A healthy digital asset market needs strong oversight, sound risk management and a commitment to protecting users. We look forward to continuing our work with VARA as we grow our business in Dubai,” said Loo.

For Bybit, the VARA license is therefore both a regulatory milestone and part of a broader expansion strategy. Loo said the company hopes to extend its licensed activities to derivatives over time, provided it receives the required approvals.

“Derivatives are a major part of Bybit’s global trading business, and we want to bring more of our offering to Dubai through the appropriate regulatory process,” said Loo.

His comments make clear that the proposed expansion remains conditional. The supplied report provides no timetable for obtaining derivatives authorization or launching those products in Dubai.

Dubai’s licensed cryptocurrency sector continues to grow

Bybit’s VARA license places it among a growing number of firms progressing through Dubai’s regulatory framework. Other businesses cited in the report include Kraken’s parent company, Payward, and digital asset trading firm Flowdesk.

Payward received full Dubai approval earlier in the month covered by the report, while Flowdesk obtained broker-dealer authorization in August. These developments illustrate continued activity within the licensing system, although the companies’ individual authorizations should not be assumed to cover identical services.

The VARA register cited in the supplied account listed 60 licensed firms and another 24 with in-principle approval. Those categories distinguish businesses that have reached licensed status from those holding preliminary approval.

For Bybit, the next stated objective is to expand its authorized activities. The VARA license marks progress in Dubai, while the company’s derivatives plans remain dependent on a further regulatory decision.