A Bybit user says roughly 7,032 USDT has remained inaccessible for nearly two months after an attempted withdrawal triggered a compliance review, raising questions about how long cryptocurrency exchanges can restrict account access while conducting risk checks.
The user detailed the case in an Aug. 24 post on the r/BybitCard subreddit, saying the restriction began on June 30 after an attempt to withdraw 805 USDT over the TRON network using TRC20. According to the post, Bybit stopped the transaction after identifying the destination wallet as high risk and advised the user by email to try a different address.
The withdrawal did not proceed, but the user said the account was subsequently placed under a broader compliance restriction.
Nearly two months later, the compliance ticket was still listed as “Ongoing,” withdrawals remained unavailable and about 7,032 USDT could not be accessed, according to the account. The user said they had contacted Bybit support multiple times but had received no completion date and had not been asked to submit additional documents.
The claims come from a Reddit user and could not be independently verified.
The circumstances described in the post broadly match a risk-control mechanism documented by Bybit itself. The exchange’s current withdrawal guidance says users can receive a risk warning when its systems identify a potential security risk associated with a destination address.
Bybit advises customers in that situation to use another withdrawal address. It also says a withdrawal can be rejected if an address is deemed high risk and that an account may face withdrawal restrictions until additional verification documents are provided by email, if required.
That makes the initial intervention described by the Reddit user consistent with a process Bybit publicly documents. The dispute is instead centered on what happened afterward: the length of the review and the alleged absence of a request for further information.
The user said they were prepared to provide identity, source-of-funds or other compliance documentation but had not been told that anything further was required.
They also said they had asked Bybit to identify the legal entity governing the account, the applicable terms, governing law and formal dispute-resolution process, but claimed those questions had not received a substantive answer.
That question can matter because Bybit now operates through different regulated structures depending on the customer and jurisdiction.
Bybit EU GmbH received authorization from Austria’s Financial Market Authority as a crypto-asset service provider under the EU’s Markets in Crypto-Assets Regulation in May 2025. The authorization covers services including custody, crypto exchange and transfers.
Bybit has also been moving European Economic Area customers away from parts of its global platform. In a June 29 notice, the company said access to certain Bybit Global services would be progressively limited for EEA residents as it directs regulated European activity through Bybit EU.
Separately, Bybit says that new users joining its global platform from Jan. 19, 2026 are onboarded through a UAE-incorporated entity regulated by the country’s Securities and Commodities Authority.
The Reddit user did not disclose enough jurisdictional or account information to independently establish which Bybit entity governs the disputed account.
The complaint is also not the only recent community report concerning lengthy compliance checks, although separate Reddit claims do not establish a broader problem at the exchange.
An Aug. 17 post in r/CryptoCurrency alleged that another Bybit account had been frozen since June 25, with the user reporting that support had provided no resolution after more than seven weeks.
Another user posting in r/Bybit_EU on Aug. 11 claimed that around $40,000 had been inaccessible since July 16 while a compliance review remained open. That user similarly said no additional documents had been requested.
Bybit’s terms give the platform broad powers to take action while carrying out anti-money laundering and counter-terrorism financing checks. Its compliance documentation says measures can include freezing, withholding or refusing transactions or accounts while an investigation or compliance review is pending. The documentation also says customer due diligence can involve information about identity, transaction purpose and source of funds.
The unresolved question in the latest complaint is therefore not whether Bybit can screen risky withdrawals. Its own documentation makes clear that it can.
The more difficult issue is how long that intervention can remain unresolved when, according to the customer, there is no outstanding request for information.
The Bigger Risk Is Not the Initial Freeze but the Compliance Black Box
There is an important distinction between a crypto exchange stopping a suspicious withdrawal and leaving an entire account in limbo.
The first is what users should expect from a regulated financial platform. Exchanges that allow a flagged address to receive funds without additional checks expose themselves and their customers to sanctions, money-laundering and fraud risks. An automated system catching a potentially problematic destination is therefore not, by itself, evidence that something has gone wrong.
In fact, Bybit openly tells customers that high-risk withdrawal addresses can trigger restrictions.
The problem starts when the process ceases to have a visible next step.
If the Reddit account is accurate, Bybit identified the original address as problematic, told the user to choose another address, then restricted withdrawals for almost two months without requesting further documentation. That creates a very different customer problem from an ordinary AML check.
A user can respond to a request for a bank statement, source-of-funds evidence or wallet-ownership verification. There is little a customer can do with an indefinite “under review” status.
This is particularly important for centralized crypto exchanges because customers do not control the private keys to assets held on the platform. A balance showing 7,032 USDT in an account may establish what the platform records as belonging to the customer, but it does not provide the same practical control as holding those assets in a self-custodied wallet.
Compliance restrictions expose that difference very quickly.
There is also a regulatory irony here. Crypto exchanges have spent years moving toward licensed structures precisely to give customers clearer protections and more accountable counterparties. Bybit itself has expanded its regulated footprint in Europe and the UAE and says it serves more than 80 million users globally.
As those structures become more complex, however, knowing which legal company actually holds a customer’s assets becomes increasingly important.
A global brand can sit above multiple licensed entities with different regulators, terms and complaint procedures. If a customer cannot easily determine which one controls the account, escalating a prolonged restriction becomes considerably harder.
None of this establishes that the Reddit user’s funds are being improperly withheld. There may be compliance information or risk factors that Bybit cannot disclose publicly, and AML investigations frequently limit what financial firms can tell customers while a review is active.
But that does not eliminate the operational issue.
For an exchange, the strongest defense against complaints about compliance freezes is not necessarily fewer freezes. It is a clearer process around them: acknowledgment that a case has reached the correct team, specific requests where customer action is required, an identifiable escalation route and enough information for the user to know which regulated entity is responsible.
The 7,032-USDT complaint is small relative to Bybit’s overall business. The principle behind it is not.
As centralized exchanges become more regulated, the standard customers apply to them will increasingly resemble the one applied to banks and payment firms. Preventing a questionable transaction is part of that standard. Explaining what happens after the transaction is stopped is becoming part of it as well.