Bybit's Counterparty List Runs to Over 50 Names: What to Check on Balances, Withdrawals and Custody

Bybit has published a list of counterparties whose mere involvement is enough, under the exchange's own rules, to have a customer account frozen. According to an analysis by the industry portal coin-turk, the so-called Restricted Counterparty List names more than 50 platforms, payment services, mixing providers, darknet marketplaces and sanctioned organisations. Anyone who sends funds to one of these addresses, receives from one, or comes into contact with one by any other route is in breach of the exchange's terms of use, on Bybit's reading. For you as a user, that means the decisive check concerns not the future but your payment history as it already stands.

The list is both things at once: a protective instrument for the exchange, and a risk for customers who have never documented where their own funds came from.

What Bybit's Restricted Counterparty List actually is

A restricted counterparty list is a register of counterparties whose payment traffic an exchange will not tolerate from its customers. The term counterparty covers every address, every account and every service at the other end of a transaction. Unlike a state sanctions list, the decision here rests with a private company, and it is taken at that company's discretion.

According to coin-turk's analysis of September 26, 2026, the register breaks down into several groups. Among trading venues, Bybit names Garantex, Bitzlato, EXMO, Payeer, Nobitex, Bitpapa, Chatex, Cryptex, Grinex, Rapira, WhiteBird, OMPFinex, Ramzinex and Wallex, among others. The payment services and marketplaces include names such as Tetherland, Bit24 and QvaPay. Added to these are mixing services and darknet marketplaces, and finally organisations subject to international sanctions, among them the Lazarus Group.

What is notable is that, according to the same report, the list also covers trading venues that operate as regular businesses in other regions. Bybit is thus taking a commercial risk decision about what payments it will accept. Inclusion on a private list carries no assessment of those venues by any authority, and that distinction matters for the context.

What Bybit reserves the right to do after a hit

The names are the eye-catching part of this publication. The consequential part sits in the legal consequences. Where the exchange identifies a connection to a listed entity, it reserves four steps, according to the reporting: freezing or terminating accounts, restricting access to balances, liquidating affected open positions, and reporting the incident to supervisory authorities.

The liquidation of open positions deserves particular attention. If a screening hit occurs during a running leveraged position, your exit price is set by the moment the measure is taken; how the market moves plays no part. A loss arising that way is a realised loss for tax purposes. You need a set of records for it consisting of timestamp, execution price and the exchange's settlement statement, and after the fact those are often available only on request.

The report to the supervisor is the point users most often underestimate. For payment service providers and crypto custodians, that step is a statutory duty as soon as a suspicion of money laundering arises. Such a report runs without your involvement, and as a rule you do not learn of it.

Why an indirect connection is enough for screening

The word everything hangs on is indirect. A screening system does not merely check whether your withdrawal went directly to a listed address. It follows the chain across several intermediate stops and assesses how many steps lie between you and a tainted address. Two to five levels is the industry norm, with each exchange setting its own threshold and none of them publishing it.

In practice that means: you buy Bitcoin through a peer-to-peer trade, the seller withdrew those coins from a listed venue a few weeks earlier, and the hit lands on your account. You have done nothing prohibited, yet the burden of proof is yours. How the price is developing in this environment is covered in our Bitcoin price prediction; on September 27, 2026, Bitcoin stood at around 84,535 dollars according to CoinGecko data at 05:47 UTC.

Anyone wanting to keep this risk small pays attention to their venue's licensing. An exchange authorised in the European Union is subject to a defined complaints procedure and must give reasons for its decisions. Our overview of regulated crypto exchanges shows which providers meet that framework and where each company is based.

Garantex and Grinex: where Bybit's rule becomes actual EU law

For some of the venues named, the matter goes beyond the will of a single exchange: the European Union has placed them under sanctions. For you as an investor that is the decisive difference, because EU sanctions apply directly and regardless of which exchange you trade on.

The EU sanctioned Garantex in February 2025. In March 2025 the United States, Germany and Finland shut down the platform's infrastructure in a joint operation, seized the main domain and, according to the authorities involved, froze more than 26 million dollars in crypto assets. Germany was therefore itself party to that operation.

The business then shifted to the successor platform Grinex, registered in Kyrgyzstan. The United States, the United Kingdom and the EU sanctioned Grinex in August and October 2025. In April 2026 Grinex ceased operations after unknown parties drained balances from its wallets; estimates of the amount range from around 13 to 13.7 million dollars. The analytics firm Chainalysis has documented the episode.

Which individuals, companies and bodies currently appear on the EU lists is published by the European Commission in its overview of restrictive measures. That is the authoritative source, not any single provider's list.

How to check the origin of your balance yourself

The only check that helps you now is the backward-looking one. Download the full transaction export for your account, at Bybit as at any other exchange, and work through it from the oldest deposit onwards. You are looking for three things: deposits from peer-to-peer trades, deposits from platforms you can no longer identify today, and inflows from periods in which you used services designed to obscure transactions.

Each of these entries belongs in your files with supporting evidence: the trade confirmation, the bank statement for the transfer, the dated chat log of the peer-to-peer trade, the transaction hash. Assembling that is tedious, and in an emergency it is the difference between a week of clarification and a permanently frozen balance.

If your account really is frozen, the exchange will require a self-declaration on the source of funds. Which questions are standard there, and which formulations make your position worse, is set out in our piece on the self-declaration after an account freeze.

What MiCA and anti-money-laundering law require of exchanges

Bybit is not acting out of high spirits. Since the Markets in Crypto-Assets Regulation, MiCA for short, providers need authorisation to do business with customers in the EU, and with that authorisation come duties to monitor payment traffic. On top of it sits the EU anti-money-laundering regulation, which requires obliged entities to monitor transactions continuously and to report suspicious cases.

The practical consequence is uncomfortable: the more thoroughly a provider discharges its duties, the more often screening also catches uninvolved customers. A venue that freezes nobody has no functioning system.

What an account freeze means for withdrawals and tax

A freeze hits you in three places at once. Access to the balance falls away, open positions can be closed, and the clarification takes time. Where a hit is sanctions-related, a release without an official decision is often not possible at all, because the provider would otherwise be in breach of the sanctions rules itself.

For tax purposes a frozen balance remains your property. A forced sale by the exchange is a disposal, and whether it occurred inside or outside the one-year holding period decides the tax liability. So document the time and price of every forced closure immediately, while you still have access to the view.

When switching venues is the better answer

Anyone holding their entire balance at a provider whose compliance rules they cannot influence carries a concentration risk. The obvious answer is to spread it across more than one venue, at least one of them authorised in the EU. When switching, though, the tax consequences need watching, because a transfer between your own wallets is not the same as a sale. What matters is whether ownership changes. If you move coins to an address that belongs to you, there is no disposal and the one-year holding period continues to run; you do have to carry the acquisition data with you, though, because the new exchange does not know it.

In September 2026 the exchange had already set deadlines when delisting two tokens, forcing customers to act. The pattern is similar: the announcement comes, and implementation follows faster than most users can get their records together. Anyone who starts searching only once the hit lands is negotiating from the weaker position.

Custody in your own hands: limits and price

The most reliable protection against an account freeze is whatever is not sitting in the account. No exchange can freeze coins held in your own custody, and that is precisely why self-custody gains ground after every major incident. A hardware wallet is a device that keeps your private keys offline and releases transactions only after confirmation on the device itself. Which models meet the requirements and what they cost is set out in our hardware wallet comparison.

The price of that independence is responsibility. A lost recovery phrase means final loss, and nobody can reset it. On top of that, self-custody does not solve the provenance problem: tainted coins stay tainted, and the next time they pass through an exchange the same hit appears again.

Why mixing services make things worse

A mixing service blends transactions from several users to make attribution harder. From the point of view of the analytics tools, however, such blending is itself a feature that flags a chain. Anyone moving a balance through such a service after a freeze makes clarification practically impossible and additionally draws the supervisor's attention.

What to watch with Nobitex, Rapira and the remaining names

For some of the names, the relevance to European users is obvious; for others it is not. Platforms focused on Iran or Russia play no part for most investors here. They become relevant through peer-to-peer trading and through acquaintances who pass on balances from there.

So check specifically whether any of your deposits originates from the orbit of one of these platforms. If you find a hit, gather the evidence before you initiate a larger withdrawal. A withdrawal is the moment when screening works with particular attention, and an account with no pending withdrawal request can be cleared up calmly.

Checking the counterparty list: what to take away

1. Export your payment history and flag three categories. Work through your deposits from the oldest onwards and mark peer-to-peer trades, inflows you cannot attribute, and amounts from the orbit of listed platforms. File supporting evidence for each entry. Whether your provider holds an EU authorisation at all can be checked in the overview of regulated crypto exchanges.
2. Spread your balance across more than one venue. A single provider with the power to freeze is a concentration risk. For the second account, pay attention to the company's domicile and licence; the candidates are in our crypto exchange comparison.
3. Move the holdings you intend to keep into your own custody. What sits on your own hardware cannot be frozen by any exchange. Store the recovery phrase separately from the device; the devices are set out in the hardware wallet comparison.

(As of September 27, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)