TLDR
- German police shut down eXch and seized €34M in crypto.
- eXch was linked to the $1.4B Bybit hack in 2025.
- The platform helped launder stolen crypto funds.
- eXch operated without KYC or AML rules since 2014.
- This was the third-largest crypto seizure in the world.
German law enforcement has shut down the cryptocurrency exchange platform eXch as part of an investigation linked to the $1.4 billion Bybit hack in 2025. Authorities seized approximately €34 million (equivalent to $38 million) in digital assets from the platform, allegedly facilitating the laundering of stolen funds connected to the cyberattack.
The operation was announced on May 9, 2025, by Germany’s Federal Criminal Police Office (BKA) in coordination with Frankfurt’s public prosecutor’s office. According to the BKA, this marks the world’s third-largest cryptocurrency asset seizure. The confiscated funds included Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), and Dash (DASH). Investigators also secured over eight terabytes of server data from the eXch platform.
eXch Linked to the Bybit Exploit and Other Cybercrimes
Authorities suspect that eXch played a role in laundering a portion of the crypto assets stolen during the February 21 Bybit breach. The hack, which targeted one of Bybit’s cold wallets, led to the theft of approximately $1.46 billion in Ether. Investigators believe the North Korean Lazarus Group was responsible for the incident.
Following the breach, a series of obfuscation techniques were employed to conceal the movement of funds. According to cybersecurity analysts and blockchain researchers, including independent investigator ZachXBT, some of the stolen Ether was swapped through platforms such as eXch and converted across chains and coins to avoid detection. Authorities have traced some of these funds back to wallets associated with known cybercriminal networks.
History and Operations of eXch
eXch began operations in 2014 and functioned as a crypto “swapping” platform. It allowed users to exchange cryptocurrencies without undergoing standard Know Your Customer (KYC) or Anti-Money Laundering (AML) verification processes. Over the years, the platform is estimated to have processed more than $1.9 billion in crypto transactions.
The platform operated under multiple domain names, including eXch.cx, and was accessible via the clearnet and darknet. Its services were marketed to users seeking anonymity and attracted individuals engaged in illicit activities. Authorities stated that the lack of regulatory compliance and data retention made it a tool for laundering digital assets.
Platform Shut Down Ahead of Voluntary Closure
eXch had announced in mid-April 2025 that it would shut down its services by May 1. The statement, posted on a cryptocurrency forum, cited increased surveillance and regulatory pressure as reasons for the closure. However, German authorities executed the seizure just before the platform’s self-imposed deadline, likely to prevent any final attempts to move illicit funds.
The investigation into eXch also ties the platform to previous cryptocurrency thefts, including the $243 million Genesis creditor exploit and several phishing-related laundering schemes. Law enforcement agencies in Germany and cooperation from Dutch counterparts continue to investigate broader networks that may have used eXch for illegal financial operations.
Growing Efforts to Regulate Crypto in Germany
The takedown of eXch follows a broader effort by German regulators to combat money laundering through unlicensed digital finance platforms. In late 2024, authorities closed 47 crypto exchanges and seized assets, including €250,000 and several illegal Bitcoin ATMs.
Regulatory bodies continue to stress the importance of AML compliance within the digital asset sector. Platforms that fail to meet these standards are being increasingly targeted as law enforcement seeks to dismantle tools used in the digital underground economy.
