German Federal Criminal Police (BKA) seized eXch

[Trêvoid]

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

by the Federal Criminal Police Office (BKA)
on behalf of the Attorney General's Office in Frankfurt am Main
in the course of a coordinated law enforcement operation.

[TryNinja]

Damn.

Here is the press release in German: https://www.presseportal.de/blaulicht/pm/7/6029813

Google translation:

Crypto swapping service "eXch" shut down Cryptocurrencies worth around 34 million euros seized

On 30.04.2025, the Frankfurt am Main Public Prosecutor's Office - Central Office for Combating Internet Crime (ZIT) - and the Federal Criminal Police Office (BKA) seized the server infrastructure of the crypto swapping service "eXch" located in Germany and shut down the platform. The service was available under the domain eXch.cx and various other Internet addresses. In addition to extensive data of over eight terabytes, the crypto assets Bitcoin, Ether, Litecoin and Dash were seized, currently worth the equivalent of about 34 million euros. It is the third-highest seizure of crypto assets in the history of the BKA.

eXch was a service that had been in existence since 2014 and allowed users to exchange different cryptocurrencies for other cryptocurrencies (known as "swapping"). The platform was accessible on both the clearnet and the darknet and specifically advertised on platforms of the criminal underground economy (UE) that it would not implement any anti-money laundering measures. Users did not have to identify themselves to the service, nor was user data stored there. In this respect, crypto swapping via eXch was particularly suitable for concealing financial flows. Since the service's inception, an estimated $1.9 billion in crypto assets have been transferred. There is a suspicion that eXch received Bitcoin of criminal origin in particular. Among other things, part of the stolen sum of 1.5 billion US dollars from the crypto exchange Bybit, which was hacked on 21.02.2025, is said to have been exchanged via eXch.

The operators of eXch are therefore suspected of commercial money laundering and the operation of a criminal trading platform on the Internet.

The operators had initially announced at short notice that they would discontinue their service on 01.05.2025. The authorities preempted this and secured numerous pieces of evidence and traces. Despite a short preparation time, the platform's database and the associated crypto assets were secured. In the investigation, ZIT and BKA cooperated closely with the Dutch Tax Investigation Service (FIOD). ZIT and BKA assume that the findings gained in the proceedings will also contribute to the investigation of a large number of other cybercrimes.

Carsten Meywirth, Director at the Federal Criminal Police Office and Head of the Cybercrime Department, said: "Once again, we have secured a record-breaking amount of incriminated cryptocurrencies in the millions and pulled the plug on a digital money laundering platform. The dimensions impressively show that cybercrimes are committed on an industrial scale. We will continue to increase the risk of loss for the underground economy with all the means at our disposal. Our goal remains to hold those responsible accountable."

Dr. Benjamin Krause, Senior Public Prosecutor of the ZIT added: "Crypto swapping is an essential part of the underground economy in order to conceal incriminated funds from illegal activities such as hacking or the trade in stolen payment card data and thus make them usable for the perpetrators. This makes it all the more important that law enforcement authorities take consistent action against such rapid and anonymous opportunities for money laundering at any level and deprive the perpetrators of the proceeds of the crime."

[examplens]

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

Where did you get this page?
When I try to open exch.net, I get an error page saying the site is unavailable. As far as I can see, exch.cx is still redirected to the .pw domain and contains information that exch is shut down.

Now I'm not sure how to contact them further, whether the .cx domain and the associated email addresses are still under the control of the eXch team.

[Trêvoid]

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

Where did you get this page?
When I try to open exch.net, I get an error page saying the site is unavailable. As far as I can see, exch.cx is still redirected to the .pw domain and contains information that exch is shut down.

Now I'm not sure how to contact them further, whether the .cx domain and the associated email addresses are still under the control of the eXch team.

Where did you get this page?

- using onion link you can see seizurebanner.jpg

http://hszyoqwrcp7cxlxnqmovp6vjvmnwj33g4wviuxqzq47emieaxjaperyd.onion/

[_act_]

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

The law enforcement seized $38 million from exch and it was said to be connected to the Bybit hack. That means exch received the coins from the North Korean hackers but not did not process the transaction and hold it? Or the is just a lie from the prosecutors by seizing the coins from the exchange because we know that the exchange is having money on its own.

[OmegaStarScream]

The law enforcement seized $38 million from exch and it was said to be connected to the Bybit hack. That means exch received the coins from the North Korean hackers but not did not process the transaction and hold it? Or the is just a lie from the prosecutors by seizing the coins from the exchange because we know that the exchange is having money on its own.

From my understanding of the translated statement above (not sure if you read something else somewhere?) and from what I have seen before from ZachXBT and others on Twitter, I don't believe they ever froze any funds from Bybit hack. The seized money probably comes from the exchange's hot wallets (their liquidity pools) they used to process users transactions.

[dkbit98]

It is much more profitable to be government this days, it pays of much more than doing any other business, easy profit from bunch of taxes, plus seizing crypto all the time.
Now they are going to apply their magic and make all that millions in crypto magically ''clean again''  
This is blueprint for ''strategic reserves'', today eXch, tomorrow regular people.

[un_rank]

This is like chipmixer all over again. I had not directly used eXch, but bitcoin needs services like this to aid privacy and give users an outlet from having to trade on centralized platforms.

Here is the press release in German: https://www.presseportal.de/blaulicht/pm/7/6029813

I could damn well predict what the content will be before reading it.

- Jay -

[Trêvoid]

It's truly sad to see exch.net, a pioneer in privacy-focused instant crypto exchanges, seized and shut down despite its important role in advancing anonymous transactions.

The law enforcement seized $38 million from exch and it was said to be connected to the Bybit hack. That means exch received the coins from the North Korean hackers but not did not process the transaction and hold it? Or the is just a lie from the prosecutors by seizing the coins from the exchange because we know that the exchange is having money on its own.

North Korea Lazarus Group used a variety of laundering techniques, including sending stolen funds through numerous wallets, moving assets across blockchains, and using services like eXch to swap and anonymize the crypto.

Ref:
(https://www.elliptic.co/blog/bybit-hack-largest-in-history)
(https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk)

Looks to me they did processed that funds.

[Lucius]

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

[Trêvoid]

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

For the servers in the EU (tough stance on cybercrime) to me also doesn't make sense.

[hugeblack]

~ 371 bitcoins were seized, and this may appear to be their reserves. The question is what they will do with this money: will they return it to byBit or sell it at auction?
+If this happened 10 days ago, why wait so long before announcing it?

[Trêvoid]

~ 371 bitcoins were seized, and this may appear to be their reserves. The question is what they will do with this money: will they return it to byBit or sell it at auction?
+If this happened 10 days ago, why wait so long before announcing it?

According to news seized funds have not yet been declared what to do like returned or auctioned; legal processes will determine their fate for sure.

[Lucius]

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

For the servers in the EU (tough stance on cybercrime) to me also doesn't make sense.

If my memory serves me right, CM and some other mixers who suffered the same fate also had servers in the EU - so while I'm not saying it would have been better if they were located somewhere else, it might not have been so easy for those agencies to locate and seize them.

To me, it seems like an attempt to hide where you think they won't be looking for you, but they obviously haven't learned from the mistakes of others before them.

[Trêvoid]

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

For the servers in the EU (tough stance on cybercrime) to me also doesn't make sense.

If my memory serves me right, CM and some other mixers who suffered the same fate also had servers in the EU - so while I'm not saying it would have been better if they were located somewhere else, it might not have been so easy for those agencies to locate and seize them.

To me, it seems like an attempt to hide where you think they won't be looking for you, but they obviously haven't learned from the mistakes of others before them.

Sure! Maybe they thought hosting there would give them better infrastructure or that authorities wouldn’t expect them to hide in such well-regulated places. But history shows that mixers sing EU servers often get caught anyway.

[examplens]

If my memory serves me right, CM and some other mixers who suffered the same fate also had servers in the EU - so while I'm not saying it would have been better if they were located somewhere else, it might not have been so easy for those agencies to locate and seize them.

To me, it seems like an attempt to hide where you think they won't be looking for you, but they obviously haven't learned from the mistakes of others before them.

It is not a big deal that at the time of starting these businesses, they are completely legal and run on legitimate ^hosting resources with good performance. Over time, the same business (mixers, no-kyc swap) becomes less legal and can easily be targeted from many sides, and then it will be too late to move to some more anonymous servers.
The whole thing about eXch escalated in two months, all after the Bybit hack.

Otherwise, will FIOD and BKA (whoever holds the confiscated coins) keep the entire amount, or will they forward Bybit his part and the claim bounty reward?

[Darker45]

...seized and shut down despite its important role in advancing anonymous transactions.

It's not despite of but precisely because of "its important role in advancing anonymous transactions" that their site is seized. It's not like the authorities are shutting down something that's helping them implement the laws. They're shutting down something that's actually making their work hard. They don't like privacy and anonymity.

I'm surprised that despite eXch's claim that they have some friends in the intelligence sector, which precisely helped them decide to shut down their service in advance in a show of defensive move, there's still over 8 terabytes of data and €34 million left to be seized.

It made me curious. It doesn't even matter what these funds are for or these data are about, or whether they're incriminating or not. What's interesting is that they made their exit weeks ago and yet a considerable amount of data and a huge amount of money are still left when the authorities arrived.

[LoyceV]

Otherwise, will FIOD and BKA (whoever holds the confiscated coins) keep the entire amount, or will they forward Bybit his part and the claim bounty reward?

Bybit's hackers stole Ethereum (from their "cold" wallet....). One way or another, seized Bitcoin didn't come from them. Isn't that the whole idea of "taint", or can "taint" transfer to different blockchains now?

[nonlogs]

I find it very strange that the eXch was obviously very well informed about what was going to happen, and that they left so many funds behind even though they had plenty of time to put them away safely. In addition, I don't understand why they used servers in the EU at all, it doesn't make any sense to me considering that Germany and the Netherlands are very rigorous when it comes to things like this - this is not the first time they have carried out such actions.

I think they got the news early.

[Orange89]

Otherwise, will FIOD and BKA (whoever holds the confiscated coins) keep the entire amount, or will they forward Bybit his part and the claim bounty reward?

Bybit's hackers stole Ethereum (from their "cold" wallet....). One way or another, seized Bitcoin didn't come from them. Isn't that the whole idea of "taint", or can "taint" transfer to different blockchains now?

Honestly these whole thing feel like watching the same movie over and over again
Another MIXER had goes down & another seizure get announced with fenfarbut yes
somehow these game is just keep going
The player had adapted the tools had get evolved and law enforcement scramble on them to catch up again

What I Really Find Interesting isn’t just how much money that is seized that's somewhere around €34 million well it's no joke bro it's huge money

but my curiosity why they left so much behind??
If they really know the heat was about to coming on them we do think that they at least move the money
Maybei  think it is not about being careless but maybe it’s about not want to raise any flags by suddenly shifting server or doing funds last minute.

As for now I think WHERE ALL THAT CRYPTO ENDS up now that’s one of  the real question
will Bybit Will Even Get A Slice?
Will Victims Ever See A Dime?
Or I think More likely it is just going to be disappearing into government vault or it can be gets quietly auctioned off under PoC till we see any real restitution

📌 More ever whatever happen
It is just a reminder for everyone again
if you are relying on centralized exchange for your privacy or being anonymous then you are always one raid away from exposure.

Keep all your wallet In Hardware or some Ledger or Hardware also
The government just wanted all of the control in everything  😫