Reviewed guide | 2026-10-12
Bybit sub-accounts as a custody tool: how well do they separate risk?
Sub-accounts on Bybit let users split funds by purpose, with separate balances, API keys, and permissions. We review how effective they are for limiting the damage of mistakes or compromised tools.
Bybit | the reader's region | the reader's funding currency | independent comparison and evidence
Keeping everything in one Bybit account is simple until something goes wrong: a bot misbehaves, an API key leaks, or a leveraged trade on cross margin eats into savings you never meant to risk. Bybit's sub-account feature is designed to separate funds and permissions within a single verified identity. In this review we look at how well that separation works in practice, where its limits are, and how an ordinary user can set it up without creating new risks. We evaluate it as a custody control rather than as a trading feature.
What a sub-account separates
Each sub-account has its own balances, positions, and API keys. Margin calls or liquidations in one do not draw on funds held in another. That is the core benefit: a strategy running in a sub-account can only lose what you have placed there. Transfers between main and sub-accounts are controlled from the main account, which keeps central control in one place.
API keys scoped to a sub-account
Creating API keys inside a sub-account rather than the main account limits what a third-party tool can reach. If the tool or key is compromised, the exposure is the sub-account balance. In our view this is the most valuable use of the feature, and it is underused. The Bybit help centre explains how to create sub-account keys and set their permissions.
Where separation stops
Sub-accounts share your identity and are ultimately controlled by the main account. If the main account itself is compromised, an attacker can move funds between sub-accounts. So the main account needs the strongest protection: passkey or authenticator, withdrawal whitelist, and alerts. Sub-accounts reduce operational risk; they do not replace account security.
Our overall verdict
As a custody control, Bybit sub-accounts are effective for isolating strategies and third-party tools, and straightforward to set up. They are most valuable for users running bots or experimenting with leverage. Their limit is dependence on main account security. We recommend keeping long-term holdings in the main account without API keys, and funding sub-accounts only with what each strategy needs.
Risk boundary: Bybit Independent Review
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Run each bot or strategy in its own sub-account with only the funds it needs.
- Create third-party API keys inside sub-accounts rather than in the main account.
- Protect the main account with passkey, whitelist, and alerts since it controls all.
- Keep long-term holdings in the main account with no API keys attached to it.
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat.