Bybit Withdrawal Freeze Reports Expand After 10 USDT High-Risk Flag

One of the latest reports concerns a user who said a 10 USDT withdrawal through the TRON network was rejected on Sept. 3 after Bybit classified the destination address as high-risk. The user said the transaction was intercepted before it was broadcast to the blockchain, meaning the 10 USDT never actually left Bybit.

According to the complaint, however, the account was restricted immediately afterward, affecting withdrawals and other functions. A compliance appeal was automatically opened at 22:20 on Sept. 3, with Bybit initially telling the customer that the case would be reviewed within 48 hours.

Six days later, the user said the appeal remained open without a substantive update. The complaint also said the appeal’s “Updated” timestamp remained identical to its creation timestamp, while no additional documentation, source-of-funds information or wallet-ownership verification had been requested.

Bybit’s support responses, as reproduced in the same public complaint feed, said the case was being reviewed by a specialized team and that there was no estimated completion time. The customer said support also confirmed that funds remained in the account but could not be moved until the review was completed.

The report is unverified and represents the customer’s account of events. It does not establish why Bybit restricted the account or whether the destination address actually presented a compliance risk beyond the platform’s automated classification.

But other recent public complaints show similar features.

A Trustpilot reviewer said their account was restricted after a 130 USDT TRC20 withdrawal was intercepted on Sept. 5 because the destination was classified as a “high risk” address. The user said the transaction never left Bybit, yet the entire account was subsequently restricted under an internal review. Bybit’s public response said it was sending the case directly to its compliance team.

Another complaint involves approximately $11,645 in USDT that the user said had remained unavailable since April. The customer said they had already submitted the requested enhanced-due-diligence information, while Bybit subsequently responded publicly that the case was being moved directly to a senior compliance team.

Additional complaints cite restrictions lasting more than 60 days. In one case, a user said withdrawals had been restricted since June 30, while Bybit responded that the restriction was being handled as part of a compliance review and that such reviews could take time. The exchange later said it was escalating the matter directly to compliance.

Another reviewer reported more than 70 days of restrictions and said Bybit had again referred the matter to compliance on Sept. 9.

These cases should not automatically be treated as evidence of a systemic freeze policy. Crypto exchanges routinely use automated risk controls to identify suspicious or sanctioned addresses, and a rejected transaction can legitimately initiate additional review. Bybit’s own documentation says withdrawals can be restricted for security and compliance reasons, while local versions of its platform also describe cooling periods for certain transactions.

What makes the latest reports worth monitoring is the apparent disconnect between the size of the attempted transaction and the duration of the resulting restriction.

The Small-Withdrawal Pattern Is the More Interesting Question

The 10 USDT complaint would be relatively unremarkable if Bybit had simply rejected the destination address.

The potentially significant part is what allegedly happened next.

According to the customer, the flagged transaction never reached the blockchain. The funds returned to the Bybit account, yet the rejection was followed by a restriction affecting the wider account. If independently confirmed, that would indicate that the triggering event is not necessarily the successful movement of suspicious funds but the attempted interaction with an address that Bybit’s risk system considers problematic.

That distinction matters for users because blockchain transactions are increasingly intertwined with third-party services. A customer may have little knowledge of why an external address has been classified as high-risk. It could belong to a service that has exposure to another wallet, a mixer, a sanctioned entity or a transaction history that the customer never knew about.

Automated screening is therefore useful from an AML and security perspective, but false positives can have a very different consequence when the response is an account-wide restriction rather than simply rejecting the individual transaction.

The emerging public complaints also raise questions about the manual-review bottleneck.

Bybit’s responses do provide one important confirmation: the exchange is publicly acknowledging that some of these cases have been escalated to compliance or senior compliance personnel. That is different from proving the customers’ broader allegations, but it establishes that the cases are not simply imaginary support interactions.

The more difficult issue is duration.

A 48-hour expectation becoming six days is one thing. A restriction lasting 60 or 70 days is a substantially different operational problem, particularly when customers say they have received no new document requests and no concrete completion date.

There is also a recurring complaint that support tickets are marked “resolved” while the underlying account restriction remains active. That does not necessarily mean Bybit is manipulating statistics; a support ticket can be closed while a separate compliance investigation remains open. But it creates an obvious communication problem for customers who interpret “resolved” as meaning their funds should be accessible.

For Bybit, the distinction between automated detection and manual investigation is becoming increasingly important. A risk engine can flag millions of transactions quickly. A human compliance team cannot review millions of cases at the same speed.

If the number of false positives or complex cases has increased, the resulting backlog could explain at least some of the complaints without implying a liquidity problem.

That is why this cluster should not be folded into the earlier bankruptcy speculation. There is no evidence in these complaints that Bybit lacks the assets to meet customer liabilities. The reports instead point toward a potential compliance-process and customer-service story.

The next useful evidence would be resolution data.

Do users eventually regain access? Are restrictions lifted after documentation is supplied? Are the same categories of external addresses repeatedly triggering freezes? How long do comparable cases actually remain open? And, critically, how often does a rejected transaction that never reaches the blockchain result in an account-wide restriction?

Those questions can turn a collection of anecdotes into a measurable pattern.

For now, the Sept. 10 report strengthens the case for continued monitoring of Bybit’s compliance-related complaints, particularly those involving small TRC20 withdrawals and “high-risk” destination warnings. But the evidence remains customer-generated and unverified, while Bybit’s public responses confirm that at least some of the cases are being escalated for compliance review.

That is enough to keep the cluster on the radar. It is not enough to conclude that Bybit is experiencing a systemic withdrawal crisis.