German Authorities Dismantle Crypto Exchange eXch in €34M Seizure Linked to Bybit Hack and Other Cyber Crimes

On April 30, 2025, German authorities, including the Frankfurt Public Prosecutor’s Office and the BKA, shut down the cryptocurrency exchange eXch, seizing €34 million in digital assets and over eight terabytes of data. Operating since 2014, eXch is suspected of laundering over $1.9 billion, including funds from the $1.5 billion Bybit hack and the $243 million Genesis theft. The platform's lack of AML and KYC protocols made it attractive for illicit activities. This operation is one of Germany’s largest actions against crypto-related financial crime.

A Coordinated Crackdown on Crypto Laundering

On April 30, 2025, German law enforcement agencies, including the Frankfurt am Main Public Prosecutor’s Office, the Central Office for Combating Internet Crime (ZIT), and the BKA, executed a coordinated raid on eXch’s infrastructure. Authorities seized the platform’s servers and confiscated digital assets across multiple cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), and Dash (DASH). The operation also resulted in the collection of more than eight terabytes of forensic data, which investigators say will be critical in mapping the platform’s role in global crypto laundering networks.

The seizure was officially announced on May 9, 2025, and is considered the third-largest crypto asset confiscation in BKA’s history.

eXch: A Platform Built for Anonymity

Founded in 2014, eXch operated as a crypto swapping service accessible via both the clearnet and darknet. The platform explicitly advertised its lack of anti-money laundering (AML) and know-your-customer (KYC) protocols, allowing users to exchange digital assets without identity verification or transaction monitoring. According to the BKA, this design made eXch particularly attractive to criminal actors seeking to obscure the origin of illicit funds.

Authorities stated that eXch was promoted on darknet forums as a high-speed, anonymous crypto mixer. Its infrastructure enabled users to swap between major cryptocurrencies without leaving a traceable footprint, effectively turning it into a hub for laundering proceeds from cybercrime.

Links to Major Crypto Breaches

Investigators allege that eXch played a central role in laundering funds from several high-profile crypto thefts. Among the most significant is the February 2025 Bybit hack, in which approximately $1.5 billion was stolen. German authorities confirmed that a portion of the stolen assets was funneled through eXch. The platform is also suspected of processing funds from the $243 million Genesis creditor theft and other exploits, including the FixedFloat and Multisig hacks.

Blockchain analytics firm TRM Labs corroborated these findings, identifying eXch as a primary destination for laundering stolen crypto assets. Independent blockchain investigator ZachXBT also reported that eXch had a long history of facilitating illicit transactions, including those linked to phishing campaigns and child sexual abuse material, with over $300,000 in such transactions traced to the platform.

Timing and Tactics

The operation was strategically timed. eXch had announced on May 1 that it would shut down due to "international pressure." However, German authorities acted one day earlier, on April 30, to secure evidence before the platform could be dismantled by its operators. Officials stated that this timing allowed them to preserve critical data and infrastructure that might have otherwise been lost.

Despite the shutdown announcement, blockchain monitoring tools indicated that eXch’s API remained active after April 30, raising concerns that some backend services may have continued to process transactions. Investigators are now analyzing the seized data to determine the full extent of the platform’s post-announcement activity.

International Collaboration and Ongoing Investigations

The investigation into eXch’s operations is ongoing and has expanded beyond Germany. Dutch law enforcement agencies are reportedly collaborating with German authorities to explore the platform’s connections to broader cybercrime networks across Europe. The case is part of a growing trend of international cooperation aimed at dismantling unregulated crypto infrastructure used for illicit purposes.

Officials have not yet disclosed whether any arrests have been made or charges filed. However, they emphasized that the forensic analysis of the seized data is expected to yield further leads.

A Pattern of Regulatory Enforcement

The takedown of eXch follows a series of similar actions by European authorities targeting crypto services that facilitate anonymous transactions. In recent years, platforms such as ChipMixer, Sinbad, and Hydra have also been dismantled for their roles in laundering criminal proceeds. These operations reflect a broader regulatory push to bring transparency and accountability to the crypto ecosystem.

German officials underscored the importance of such actions in a statement: “It is therefore all the more important that law enforcement agencies consistently take action against such quick and anonymous opportunities for money laundering of any amount and deprive perpetrators of the proceeds of the crime.”

eXch’s Final Message

Before its shutdown, eXch’s operators issued a final statement denying any intent to support criminal activity. They claimed the platform was designed to offer privacy-focused alternatives and argued that regulators were unfairly targeting services that prioritize user anonymity. “We never had any goals to serve criminals,” the message read. “We are not liable for any misuse.”

However, critics and investigators argue that the platform’s lack of oversight and its promotion on criminal forums made it a magnet for illicit activity. The absence of AML and KYC controls, combined with its longevity and reach, positioned eXch as a key node in the global laundering of stolen digital assets.