Bitcoin Forum

by the Federal Criminal Police Office (BKA)
on behalf of the Attorney General's Office in Frankfurt am Main
in the course of a coordinated law enforcement operation.

Crypto swapping service "eXch" shut down Cryptocurrencies worth around 34 million euros seized

On 30.04.2025, the Frankfurt am Main Public Prosecutor's Office - Central Office for Combating Internet Crime (ZIT) - and the Federal Criminal Police Office (BKA) seized the server infrastructure of the crypto swapping service "eXch" located in Germany and shut down the platform. The service was available under the domain eXch.cx and various other Internet addresses. In addition to extensive data of over eight terabytes, the crypto assets Bitcoin, Ether, Litecoin and Dash were seized, currently worth the equivalent of about 34 million euros. It is the third-highest seizure of crypto assets in the history of the BKA.

eXch was a service that had been in existence since 2014 and allowed users to exchange different cryptocurrencies for other cryptocurrencies (known as "swapping"). The platform was accessible on both the clearnet and the darknet and specifically advertised on platforms of the criminal underground economy (UE) that it would not implement any anti-money laundering measures. Users did not have to identify themselves to the service, nor was user data stored there. In this respect, crypto swapping via eXch was particularly suitable for concealing financial flows. Since the service's inception, an estimated $1.9 billion in crypto assets have been transferred. There is a suspicion that eXch received Bitcoin of criminal origin in particular. Among other things, part of the stolen sum of 1.5 billion US dollars from the crypto exchange Bybit, which was hacked on 21.02.2025, is said to have been exchanged via eXch.

The operators of eXch are therefore suspected of commercial money laundering and the operation of a criminal trading platform on the Internet.

The operators had initially announced at short notice that they would discontinue their service on 01.05.2025. The authorities preempted this and secured numerous pieces of evidence and traces. Despite a short preparation time, the platform's database and the associated crypto assets were secured. In the investigation, ZIT and BKA cooperated closely with the Dutch Tax Investigation Service (FIOD). ZIT and BKA assume that the findings gained in the proceedings will also contribute to the investigation of a large number of other cybercrimes.

Carsten Meywirth, Director at the Federal Criminal Police Office and Head of the Cybercrime Department, said: "Once again, we have secured a record-breaking amount of incriminated cryptocurrencies in the millions and pulled the plug on a digital money laundering platform. The dimensions impressively show that cybercrimes are committed on an industrial scale. We will continue to increase the risk of loss for the underground economy with all the means at our disposal. Our goal remains to hold those responsible accountable."

Dr. Benjamin Krause, Senior Public Prosecutor of the ZIT added: "Crypto swapping is an essential part of the underground economy in order to conceal incriminated funds from illegal activities such as hacking or the trade in stolen payment card data and thus make them usable for the perpetrators. This makes it all the more important that law enforcement authorities take consistent action against such rapid and anonymous opportunities for money laundering at any level and deprive the perpetrators of the proceeds of the crime."

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

Where did you get this page?
When I try to open exch.net, I get an error page saying the site is unavailable. As far as I can see, exch.cx is still redirected to the .pw domain and contains information that exch is shut down.

Now I'm not sure how to contact them further, whether the .cx domain and the associated email addresses are still under the control of the eXch team.

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

The law enforcement seized $38 million from exch and it was said to be connected to the Bybit hack. That means exch received the coins from the North Korean hackers but not did not process the transaction and hold it? Or the is just a lie from the prosecutors by seizing the coins from the exchange because we know that the exchange is having money on its own.

Here is the press release in German: https://www.presseportal.de/blaulicht/pm/7/6029813

The law enforcement seized $38 million from exch and it was said to be connected to the Bybit hack. That means exch received the coins from the North Korean hackers but not did not process the transaction and hold it? Or the is just a lie from the prosecutors by seizing the coins from the exchange because we know that the exchange is having money on its own.

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

~ 371 bitcoins were seized, and this may appear to be their reserves. The question is what they will do with this money: will they return it to byBit or sell it at auction?
+If this happened 10 days ago, why wait so long before announcing it?

If my memory serves me right, CM and some other mixers who suffered the same fate also had servers in the EU - so while I'm not saying it would have been better if they were located somewhere else, it might not have been so easy for those agencies to locate and seize them.

To me, it seems like an attempt to hide where you think they won't be looking for you, but they obviously haven't learned from the mistakes of others before them.

If my memory serves me right, CM and some other mixers who suffered the same fate also had servers in the EU - so while I'm not saying it would have been better if they were located somewhere else, it might not have been so easy for those agencies to locate and seize them.

To me, it seems like an attempt to hide where you think they won't be looking for you, but they obviously haven't learned from the mistakes of others before them.

...seized and shut down despite its important role in advancing anonymous transactions.

Otherwise, will FIOD and BKA (whoever holds the confiscated coins) keep the entire amount, or will they forward Bybit his part and the claim bounty reward?

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

Bybit's hackers stole Ethereum (from their "cold" wallet....). One way or another, seized Bitcoin didn't come from them. Isn't that the whole idea of "taint", or can "taint" transfer to different blockchains now?

Bybit's hackers stole Ethereum (from their "cold" wallet....). One way or another, seized Bitcoin didn't come from them. Isn't that the whole idea of "taint", or can "taint" transfer to different blockchains now?

They escalated the "taint" to almost all blockchains.

Does that mean the "taint" is removed from the original coin? Say someone has $1 million in "tainted" ETH, and exchanges it for $1 million in Bitcoin. Those Bitcoins are now owned by the bad guy, so they're tainted. But the ETH is now owned by someone else, even though it came directly from the hack. Are they no longer tainted? Or does the "taint" apply to $2 million in ETH and Bitcoin now?
This sounds a lot like magic!

Is it possible that those 8 TB of data aren't actually data, but storage space - something similar to what happened in the case of CM? It might make sense that there is such a large amount of data, but why (and what) would a swap exchange store that takes up so much space?

Is it possible that those 8 TB of data aren't actually data, but storage space - something similar to what happened in the case of CM? It might make sense that there is such a large amount of data, but why (and what) would a swap exchange store that takes up so much space?

My theory about the value of the cryptocurrencies that were seized is that they may have been left with the intention of leaving the people who ran the whole thing alone. It's nothing new, in a way a kind of deal for the authorities to get money in exchange for giving up persecution - and besides, I think the guys behind this project made a lot more than those 30+ million euros.

Your guess is as good as mine. By the way, are we now certain of what specific data were kept by CM and seized by the authorities? Surely, however, the 7 TB wasn't just empty storage space. It must be a combination of logs, keys, other historical data, copies of the blockchain, and whatnot.


We can only speculate, but CM has also left $47 million in addition to the 7 TB of data. So far, I haven't heard of Minh Nguyen arrested. This is like a replay, although not involving a mixer anymore but only one that's mislabeled as such.

Recently, in the topic about mixers in the Meta board, someone confirmed that the person you mention is still at large - and as we can see, there are definitely some similarities between the two cases. Besides, those who launched an attack on eXch know who is behind the project - at least those who sent them a warning, right?

thats a good point but so you are saying minh nguyen could be exch? or his partner something? because as you said kind of replay

Yes, the 8 TB is likely the total data cloned, as they probably performed a forensic copy, which clones the entire hard drive (bit-for-bit), including even the free space. All blockchains were probably included in that data. (How much space does just Ethereum take up?)

i believe it could be large blockchain data directories (if running full or archive nodes) such as deleted files, system files, application data and so on...

An Ethereum node alone is about 2 TB.

Even if there were wallets with all the coins on those servers, what is the probability that they were so unprotected and that some forensic expert managed to move them immediately?
Also, what is the probability that the eXch team did not have backups offline at another location?