Toobit is a real exchange, not a phishing site. It has operated since October 2022 from the Cayman Islands, serves more than 600,000 account holders according to its proof-of-reserves scope, and has had its reserves verified by Hacken, most recently in May 2026, at more than 100% backing for BTC, ETH, USDT and USDC. Its infrastructure has been penetration-tested and Toobit Global Pty Ltd holds ISO 27001 certification. Those are more third-party checks than many offshore exchanges submit to.
The regulatory picture is thinner than the security picture. Toobit describes a FinCEN money services business registration and a Polish VASP registration. A FinCEN registration is a filing that any exchange can make; it is not a license to serve U.S. retail customers, and Toobit stopped doing so in August 2024. We could not verify any state money transmitter license, and Toobit does not claim one. For an American, the platform is offshore and off-limits.
The complaints are the ones to weigh. A recurring theme in public reviews is an account restricted after profitable trading under Toobit's compliance and risk-control policy, with gains labeled "illegal profits" and only the original deposit released. That may be a legitimate anti-abuse process misfiring, or it may be the policy working as written; either way it is a custodial risk that does not exist when the coins are delivered to a wallet you control.