Is BitOasis safe? What its custody, security and licence disclosures show
No platform can make crypto safe. Prices can fall to zero, and a BitOasis account has no financial protection scheme behind it. What you can check is what BitOasis discloses: client assets held through BitGo in segregated wallets, a majority of them offline; every spot order routed to named liquidity providers; and an operator licensed by VARA for Broker-Dealer Services (VASP Licence reference VL/2024/11/001).
Risk warning. Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The owner and/or investor in the Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection. Read the full risk disclosure statement.
Last reviewed by the Head of Compliance. BitOasis documents read on , VARA register and help centre on .
Who holds client assets
Under the BitOasis Terms of Service, wallet and custody services are provided through BitGo. Three published statements describe how client assets are held. Two details are missing: the share kept offline and how the keys are managed.
ClaimWallet and custody services are provided through BitGo. The Terms name three entities: BitGo Custody MENA FZE, BitGo Trust and BitGo Inc.
SourceCustody terms in the terms of service. Live record last modified 17 September 2026.
Read on
ClaimClient virtual assets are held in segregated wallets and are not co-mingled with company funds.
SourceBitOasis Terms of Service. Live record last modified 17 September 2026.
Read on
ClaimA majority of users' crypto is held offline in cold storage.
SourceBitOasis Security page on the live site.
Read on
ClaimThe share of client assets held in cold storage.
SourceNot published
Read on
ClaimKey management: who holds the keys, how many approvals a transfer needs and where backups are kept. No description was found on the pages sampled.
SourceNot published
Read on
Segregation keeps client assets apart from the company's own. It is not a protection scheme, and it does not stop prices falling. If you would prefer to hold your own keys, read custodial and self-custody wallets compared.
How orders are executed
BitOasis is a broker-dealer. When you buy or sell, it takes your order and routes it to a liquidity provider. Its help centre says it “operates as a brokerage”: it does not match buyers and sellers on a matching engine of its own, and it keeps no order book of its own.
The Terms of Service name the liquidity providers: Bitfinex, Aquanow and BitGo MENA FZE. They state that 100% of client spot orders are routed to them, and that neither BitOasis nor any DCX Group company trades on its own account.
So the price you get starts with those providers, and the BitOasis fee comes on top. On Lite the trading fee is 0% and the spread inside the quoted price is not published. The fees page explains how fees and prices are formed.
Sources: BitOasis Terms of Service, read 6 October 2026; BitOasis help centre, trading operations and order book transparency, modified 30 April 2026 and read 11 October 2026.
How your account is protected
- Multi-factor authentication
- BitOasis lists four ways to confirm a sign-in: biometrics, email, SMS and a time-based one-time password from an authenticator app. Source: BitOasis Security page, read 6 October 2026.
- Identity check
- Opening an account takes an ID or passport, a liveness selfie, your residential address and a source-of-funds declaration. Source: BitOasis help centre, verification documents and processing times, modified 21 April 2026.
- Withdrawals in your name
- AED withdrawals go only to a personal bank account in your own name. Source: BitOasis help centre, cash withdrawal guide, modified 1 May 2026.
- Cards in your name
- You can pay with up to 3 cards, and each must be in your own name. Source: BitOasis fee pages, read 6 October 2026.
- Official domains and email
- bitoasis.net, blog.bitoasis.net, learn.bitoasis.net, support.bitoasis.net and api.bitoasis.net. Support email is [email protected], and verification emails also come from [email protected]. Source: hosts and addresses recorded from the live site on 6 October 2026.
Independent testing and bug bounty
One form of outside testing is published: a bug bounty, where independent researchers report security flaws. No penetration-test or audit details were found on the pages sampled.
ClaimBitOasis runs a bug bounty programme hosted on YesWeHack.
SourceLink on the BitOasis home page. Issuer of the programme page: YesWeHack.
Read on
ClaimPenetration tests: the testing firm, how often it tests and the date of the latest test.
SourceNot published
Read on
ClaimIndependent security audit: the auditor, the scope and the report date.
SourceNot published
Read on
What BitOasis has not published
A check of the BitOasis pages sampled on 6 October 2026 found none of the documents below. Each one keeps its row, so that a gap reads as a gap. A missing document does not prove a problem, and it gives no assurance either.
ClaimProof of reserves: the issuer, the date and a link to the report.
SourceNot published
Read on
ClaimInsurance cover: the insurer, the limit, what is covered and the policy period.
SourceNot published
Read on
ClaimSOC 2 report: the auditor, the report type and the period it covers.
SourceNot published
Read on
ClaimISO 27001 certificate: the certification body, the certificate number and the expiry date.
SourceNot published
Read on
ClaimIncident history: the dates of any security incidents and what happened to client assets. No statement was found on the pages sampled.
SourceNot published
Read on
Regulatory supervision
BitOasis Technologies FZE is licensed by the Dubai Virtual Assets Regulatory Authority (VARA) for Broker-Dealer Services, VASP Licence reference VL/2024/11/001. The register showed the licence as Active on 11 October 2026. The licences page has the VARA licence and register entry in full.
The licence covers Broker-Dealer Services. Custody Services is a separate VARA activity and is not on it. Custody is provided through BitGo. The regulation guide explains what a VARA licence does and does not cover.
BitOasis says it has also been a Reporting Entity on the UAE Financial Intelligence Unit goAML platform since September 2021. If BitOasis does not resolve a complaint, you can refer it to VARA: see the complaints procedure and VARA referral. The company, its owners and its roles are on the page about ownership and responsible individuals.
A licence is not protection against losses. It does not stop prices falling, and it brings no financial protection scheme with it.
- Regulator
- Dubai Virtual Assets Regulatory Authority (VARA)
- VASP Licence reference
- VL/2024/11/001 Status on the register: Active
- On the licence
- Broker-Dealer Services
- Not on the licence
- Custody Services Custody is provided through BitGo
- Register read on
What you can do to protect your account
Some risks sit with the account holder, not with the platform: a reused password, a fake website or a transfer on the wrong network. Six habits lower them.
Turn on an authenticator app
BitOasis lists a time-based one-time password among its sign-in factors. An authenticator app creates the code on your phone, so it does not depend on an SMS or an email reaching you.
Use a password you use nowhere else
If another site is breached, a reused password opens your BitOasis account as well. A password manager can create and store a long one.
Check the domain before you log in
The site is bitoasis.net. Type the address yourself or start from the front page of BitOasis, and do not log in from a link in a message.
Send a small test transfer first
A crypto transfer cannot be reversed once the network confirms it. Send a small amount, check that it arrives, then send the rest. Each send carries its own network fee.
Match the network
BitOasis must support the network you send on. Its help centre lists networks it does not accept for incoming transfers, among them Polygon, Arbitrum and Binance Smart Chain (BEP-20), and says funds sent on an unsupported network may be lost. Check the supported USDT networks before a USDT transfer.
Check unexpected calls and messages
If a call, an email or a social media message claims to come from BitOasis support, confirm it through live chat or [email protected] before you act. No support phone number appears on the BitOasis home, About or Security pages. This is general guidance, not a statement of how BitOasis support works.
Source for unsupported networks: BitOasis help centre, digital assets and unsupported networks, modified 29 April 2026 and read 11 October 2026.
More on wallets, networks and regulation is in the BitOasis Learn guides.
Security questions
Is BitOasis legit or a scam?
BitOasis is run by a company you can look up: BitOasis Technologies FZE. It is on the VARA public register with the status Active, under VASP Licence reference VL/2024/11/001, as shown in the BitOasis licence details. Its owners are named on the page about the company and its owners, custody is through named BitGo entities, and its official domains are on the contact page. A licence does not remove the risk of loss.
Is my money protected if BitOasis fails?
No financial protection scheme covers a BitOasis account. Under the Terms of Service, client virtual assets are held in segregated wallets and are not co-mingled with company funds. Segregation is not the same as a protection scheme. What would happen to client assets or AED balances in an insolvency is a legal question that this page does not answer. The full risk disclosure lists the other risks.
Does BitOasis publish proof of reserves?
No proof-of-reserves page was found on the BitOasis pages sampled on 6 October 2026. The same check found no insurance statement, SOC 2 report or ISO 27001 certificate. BitOasis does state that custody is provided through BitGo and that client assets are held in segregated wallets. If a reserve report exists, it belongs on this page with its issuer and its date.
Can BitOasis trade against me?
Not according to its Terms of Service. They say that neither BitOasis nor any DCX Group company trades on its own account, and that 100% of client spot orders are routed to liquidity providers: Bitfinex, Aquanow and BitGo MENA FZE. The help centre adds that BitOasis has no matching engine or order book of its own. On Lite, the spread inside the quoted price is not published.
How do I report a suspicious message?
Tell BitOasis through live chat or by email to [email protected], and do not act on the message first. Reach the site by typing bitoasis.net, not by following a link. No support phone number appears on the BitOasis home, About or Security pages, so treat an unexpected call with care. The contact page shows where to report fraud or a security concern.
For information only, not investment advice. Questions about passwords, verification and withdrawals are among the security questions in the FAQ.
Read the risks in full before you add funds.