eXch - instant exchange BTC / LN / XMR / LTC / ETH / ERC20

[NotATether]

This is actually the most worrisome part and essentially the center of the question. The reaction toward exch, given the minuscule amount of money allegedly passed through their system (26 million out of 1,400 million total)is disproportionate.

The European governments have become hysterical about crypto in recent years, to the point that they want to ban its pseudonymous usage completely, thereby copying China. You can tell this is the case here by the fact that not a single US agency is listed in the seized banner. I usually see FBI, and DoJ in these things. There is not so much as a press release from those websites.

[LoyceV]

You can tell this is the case here by the fact that not a single US agency is listed in the seized banner.

Maybe that's the reason they couldn't seize the domain names, but somehow managed to get the .onion server.

I'm wondering though: why Germany and the Netherlands? Did they host their servers here? Their company is (was?) registered in Belize, hosting servers in Germany just doesn't make sense.

I've been thinking about this post:

Recently, we received confirmation of information we had previously, thanks to some friends we have even in the state intelligence sector, that our project is the subject of an active transatlantic operation aimed at forcibly shutting our project down and prosecuting us for "money laundering and terrorism."

It sounds like there's a mole!

Support me in my fight against shower curtains (especially in women's bathrooms and dressing rooms).

16 year old me would have approved, but I now have a daughter to think about so I can't join your fight.

Besides having their onion site seized, literally all their money has been confiscated and is located at the address bc1qcatv4gxq24z8hwt67sftjlnlm6dxnk04saz5zw.

What makes you think funds in that address are confiscated? The press release mentioned only Ether, Litecoin and Dash.

[joker_josue]

You can tell this is the case here by the fact that not a single US agency is listed in the seized banner.

Maybe that's the reason they couldn't seize the domain names, but somehow managed to get the .onion server.

I'm wondering though: why Germany and the Netherlands? Did they host their servers here? Their company is (was?) registered in Belize, hosting servers in Germany just doesn't make sense.

Despite this event, incredibly, Germany and the Netherlands continue to be among the countries with the best hosting servers in the world and even those that have a much more liberal policy regarding these issues than other countries.

Of course, this does not prevent the authorities from taking action when justified, but things really need to escalate significantly for that to happen.

[examplens]

Besides having their onion site seized, literally all their money has been confiscated and is located at the address bc1qcatv4gxq24z8hwt67sftjlnlm6dxnk04saz5zw.

What makes you think funds in that address are confiscated? The press release mentioned only Ether, Litecoin and Dash.

eXch Ethereum address appears to be intact since May 1st, when they announced the official closing. There are still some "small" amounts of funds there. 83ETH + $35k in tokens. 0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123
The fact that the last transaction is 350 ETH out to a new address.

Also, Etherscan added a note to this address: 

Code:

eXch has been taken down over reports of illicit financial activities. Please exercise caution when interacting with this address.

[Synchronice]

Why are you not so agile in sanctioning an obvious scam scheme through a network of fake blogs and phishing sites? The scam is tolerated, while the original owner is persecuted.

Code:

monero[.]forex
exch[.]cd
darknetbible[.]info

More information and evidence at: https://cryptofraudexpose.org/

They said that when services are heavily abused to commit crime, they'll act. Phishing doesn't mean heavily abused, it's lightly or moderately abused. Overall, you know, who gets caught, big cartels or small resellers? Small resellers and users, not big boys because big boys are part of the system.

By the way, it's also very strange that eXch just got seized. They closed their website a few days ago, they even announced that they were going to close it but now they got seized. What was going on? Did someone launder money through eXch, they got contacted by authorities and they turned a blind eye? As far as I remember, eXch had a valid license to run an exchange.

[Pmalek]

By the way, it's also very strange that eXch just got seized. They closed their website a few days ago, they even announced that they were going to close it but now they got seized. What was going on? Did someone launder money through eXch, they got contacted by authorities and they turned a blind eye?

After Bybit got hacked, the exchange contacted eXch and asked them to confiscate all money that gets deposited on eXch from a number of addresses where the hacker sent the stolen funds to. eXch responded to that request by asking why they would help a service that has done everything they could in the past to undermine eXch and their business. A small part of the stolen money was eventually swapped via eXch and the exchange didn't do anything. Private on-chain "investigators" together with Bybit then did everything to portray eXch as criminals and money launderers. The result, as you can see, is them shutting down their operations and also getting a part of it confiscated by law enforcement in the EU.   

[OmegaStarScream]

You can tell this is the case here by the fact that not a single US agency is listed in the seized banner.
Maybe that's the reason they couldn't seize the domain names, but somehow managed to get the .onion server.

I'm wondering though: why Germany and the Netherlands? Did they host their servers here? Their company is (was?) registered in Belize, hosting servers in Germany just doesn't make sense.

Yes, it appears so:

On April 30, 2025, the Frankfurt am Main Public Prosecutor's Office - Central Office for Combating Internet Crime (ZIT) - and the Federal Criminal Police Office (BKA) seized the German server infrastructure of the crypto swapping service "eXch" and shut down the platform.

I found this article: https://www.trmlabs.com/resources/blog/exch-remains-active-despite-shutdown-how-the-bybit-hack-linked-exchange-continues-to-enable-laundering-of-csam-funds

From the 2nd of May, where the article claims that funds linking to CSAM (Child sexual abuse material) were linked to eXch and saying that after the exchange stopped functioning on the 30th (probably when it was seized), there were still transactions going through the API.

[NotATether]

They said that when services are heavily abused to commit crime, they'll act. Phishing doesn't mean heavily abused, it's lightly or moderately abused. Overall, you know, who gets caught, big cartels or small resellers? Small resellers and users, not big boys because big boys are part of the system.

That is irrelevant, because tens of thousands of scammers abuse websites on their own to create light or moderate abuse.

Multiply all that abuse by the number of scammers, and it's an order of magnitude larger than whatever happened at eXch or any single service.

But nobody cares about all that scamming, because it is more rewarding for them to seize individual sites than to take action against scamming as a whole. The most I have ever seen an agency do about phishing is put up a notice warning people not to get phished.

What does the servers being seized mean though? Is it possible that they had access to everything, but the owners didn't knew about it until later? (like everyone else)?

It means a warrant was issued and the hosting provider surrendered the server to them. I still find it quite appalling that an exchange would operate with the vast majority of its funds on a hot wallet. This is the most souring part. I know eXch gave out free CryptoSteels around here - did they not use any of them?

[OmegaStarScream]

It means a warrant was issued and the hosting provider surrendered the server to them. I still find it quite appalling that an exchange would operate with the vast majority of its funds on a hot wallet. This is the most souring part. I know eXch gave out free CryptoSteels around here - did they not use any of them?

I also don't understand that part. Just like I don't understand the "8 Terabytes part" (reminds me of ChipMixer?) when they're not supposed to have logs. Just nodes?

The service was accessible under the domain eXch.cx and various other internet addresses. In addition to extensive data of over eight terabytes, the crypto assets Bitcoin, Ether, Litecoin, and Dash, currently valued at approximately €34 million

I might be missing something about the timing, but If everything has been seized and shutdown on the 30th... How come OP edited his original post after the incident and announced the closure as if nothing happened? also, how come TRM Labs (see above post) claims that transactions were still being processed even after the shutdown on the 30th (which at the time, they didn't knew was law enforcement).

[joker_josue]

I might be missing something about the timing, but If everything has been seized and shutdown on the 30th... How come OP edited his original post after the incident and announced the closure as if nothing happened (or at least that's what I imagine he edited)? also how come TRM Labs (see above post) claims that transactions were still being processed even after the shutdown on the 30th (which at the time, they didn't knew was law enforcement).

That's why I say something doesn't add up.
So the authorities let the website owner write a message informing them of the closure, on the same day they made the arrest?

I see this story being poorly told. From both sides, from the service owners' side, and from the authorities' side.

[hugeblack]

The good thing is that the United States wasn't part of it, and neither the forum nor the signature campaign was mentioned.

Continuing to read, I found:

The service was accessible under the domain eXch.cx and various other internet addresses. In addition to extensive data of over eight terabytes, the crypto assets Bitcoin, Ether, Litecoin, and Dash, currently valued at approximately €34 million

In the investigation, ZIT and BKA cooperated closely with the Dutch Tax Investigation Service (FIOD). ZIT and BKA assume that the findings gained in the proceedings will also contribute to the investigation of a large number of other cybercrimes.

So the coming days/weeks will tell. If they manage to catch more scammers, then eXch was storing the logs/IP/metadata.
I always assumed that the eXch account was being managed by multiple users, so it's likely that someone testified against them.

[examplens]

The good thing is that the United States wasn't part of it, and neither the forum nor the signature campaign was mentioned.

Maybe it would be better if the US Department got involved in the case. At least based on their recent decision

In response to those taskings, the Justice Department will stop participating in regulation by prosecution in this space. Specifically, the Department will no longer target virtual currency exchanges, mixing and tumbling services, and offline wallets for the acts of their end users or unwitting violations of regulations-except to the extent the investigation is consistent with the priorities articulated in the following paragraphs.

https://www.justice.gov/dag/media/1395781/dl?inline

[witwasser]

To users of the recently dismantled cryptocurrency exchange,

*****This message is issued by the Dutch Fiscal Information and Investigation Service (FIOD) and the Bundeskriminalambt (BKA).

The service has been taken offline as part of our enforcement action.

We are actively investigating individuals involved in money laundering and other illegal activities through this swap service.

Some question actions from law enforcement regarding crypto services. We want to make one thing clear:  this action is not an attack on privacy. We respect the right to privacy and recognize its importance in the digital age. However, when services are heavily abused to commit crime, we will act.

We urge everyone involved in illicit activity to cease immediately. The legal consequences can be serious. Our mission is to protect the integrity of the financial system and hold those who exploit it accountable.

Privacy is not the problem - criminal misuse is.

Sincerely,

FIOD and BKA

https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Kurzmeldungen/250509_eXch_abgeschaltet.html

https://www.fiod.nl/bka-and-fiod-shut-down-cryptocurrency-swap-service-exch-e-34-million-in-cryptocurrency-has-been-seized-during-the-operation/

Dear FIOD and BKA,

I happened to come across this piece of news and your post, though I don’t usually frequent forums – unlike, I imagine, most of us professionals. I’m curious, who exactly are you trying to scare, and what message are you trying to send here? I’ve never used that obscure exchange – it simply doesn’t have the liquidity for the volumes I work with. Cryptocurrencies, frankly, are far from the ideal solution for such activities. In your countries, however, I preferred – and still prefer – to work with ABN Amro and Deutsche Bank.

I assume you’ll understand the necessity of working with reliable institutions – after all, we professionals take our business quite seriously, don’t we?

Best regards,
Max Witwasser
Professional in the Field

[FinneysTrueVision]

Besides having their onion site seized, literally all their money has been confiscated and is located at the address bc1qcatv4gxq24z8hwt67sftjlnlm6dxnk04saz5zw.

What makes you think funds in that address are confiscated? The press release mentioned only Ether, Litecoin and Dash.

The FIOD website mentions that they were assisted by the zeroShadow cybersecurity firm. A member of that organization, tanuki42, made the claim on Twitter that this was the address where the seized funds were consolidated at. https://x.com/tanuki42_/status/1920755195060875353

[Pmalek]

I might be missing something about the timing, but If everything has been seized and shutdown on the 30th... How come OP edited his original post after the incident and announced the closure as if nothing happened?

Not only that, but the eXch Support account was last active on 6 May. That's the account that posted the anti-phishing services thread. Someone logged in with that account on 6 May but no new posts were written. I am not sure if an older post was edited or perhaps deleted. The questions is, who now controls that account?

So the authorities let the website owner write a message informing them of the closure, on the same day they made the arrest?

Arrest as in arrest of people? I don't think anyone from the eXch team got arrested. Did I miss something?

[LoyceV]

A member of that organization, tanuki42, made the claim on Twitter that this was the address where the seized funds were consolidated at. https://x.com/tanuki42_/status/1920755195060875353

Is this part 6 of the conversation? X.com doesn't want to show the rest without creating an account.

[FinneysTrueVision]

Is this part 6 of the conversation? X.com doesn't want to show the rest without creating an account.

You can view the whole thread on this nitter instance https://nitter.tiekoetter.com/tanuki42_/status/1920755186932293667#m

[Synchronice]

By the way, it's also very strange that eXch just got seized. They closed their website a few days ago, they even announced that they were going to close it but now they got seized. What was going on? Did someone launder money through eXch, they got contacted by authorities and they turned a blind eye?

After Bybit got hacked, the exchange contacted eXch and asked them to confiscate all money that gets deposited on eXch from a number of addresses where the hacker sent the stolen funds to. eXch responded to that request by asking why they would help a service that has done everything they could in the past to undermine eXch and their business. A small part of the stolen money was eventually swapped via eXch and the exchange didn't do anything. Private on-chain "investigators" together with Bybit then did everything to portray eXch as criminals and money launderers. The result, as you can see, is them shutting down their operations and also getting a part of it confiscated by law enforcement in the EU.   

Can you give me a link of article or any info about Bybit trying to undermine eXch? I didn't know about their beef.

By the way, what is this Lazarus Group? They hack every exchange, they steal every cryptocurrency, they always launder money through every crypto exchange. Who are they? How are they so powerful? Let's say that they laundered money through an exchange, that money has to be converted into fiat, right? Where do they convert it into fiat? Didn't they get caught in convertation?

That is irrelevant, because tens of thousands of scammers abuse websites on their own to create light or moderate abuse.

Multiply all that abuse by the number of scammers, and it's an order of magnitude larger than whatever happened at eXch or any single service.

But nobody cares about all that scamming, because it is more rewarding for them to seize individual sites than to take action against scamming as a whole. The most I have ever seen an agency do about phishing is put up a notice warning people not to get phished.

It's easier to fight one strong opponent instead of hundred of different ones.

[NotATether]

By the way, what is this Lazarus Group? They hack every exchange, they steal every cryptocurrency, they always launder money through every crypto exchange. Who are they? How are they so powerful? Let's say that they laundered money through an exchange, that money has to be converted into fiat, right? Where do they convert it into fiat? Didn't they get caught in convertation?

It is North Korea's cyberwarfare agency. They hack banks, exchanges, companies, put drainers on HODLer's computers and crypto developers, and they use all that money to make nukes after laundering it with the help of their black hat friends in China, Laos, Cambodia, Russia and others on Telegram groups.

This is all approved by their government by the way.

So as you can see, seizing eXch does nothing to punish Lazarus.

[hugeblack]

Maybe it would be better if the US Department got involved in the case. At least based on their recent decision

No, I don't think anything will change. they won't pursue decentralized services like the CoinJoin protocol, privacy wallets, or the actions of end users and developers.
However, they will pursue:
1) Centralized services that engage in criminal activities.
2) Individuals who use decentralized services for criminal activities.

To users of the recently dismantled cryptocurrency exchange,

*****This message is issued by the Dutch Fiscal Information and Investigation Service (FIOD) and the Bundeskriminalambt (BKA).

How did I miss this quote
Why didn't you use this account ---> https://bitcointalk.org/index.php?action=profile;u=3593363 ?
If you have time, creating a Q&A list would be helpful for the forum.

I’m curious, who exactly are you trying to scare, and what message are you trying to send here? I’ve never used that obscure exchange – it simply doesn’t have the liquidity for the volumes I work with.

This is probably a message to anyone who has access to .pw