{"investigation":{"slug":"exch","entity_name":"eXch","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.93,"status":"published","content_type":"investigation","summary":"eXch (exch.cx) was a no-KYC instant cryptocurrency swap service operating from 2014 until its forced shutdown in May 2025. Registered in Belize under the name Private Project Facilitators LTD, the platform processed an estimated $1.9 billion in total volume, deliberately advertising its absence of anti-money laundering controls on criminal underground forums. German federal law enforcement seized approximately $38 million in cryptocurrency assets and 8 terabytes of data from the platform in April 2025, following evidence linking eXch to laundering roughly $200 million of funds stolen in the $1.46 billion Bybit hack carried out by North Korea's Lazarus Group.","sections":[{"content":"eXch operated as an instant, non-custodial cryptocurrency swap service, allowing users to exchange Bitcoin, Ethereum, Litecoin, Monero, Dash, and ERC-20 tokens without creating accounts or undergoing identity verification. The platform operated on both the clearnet (exch.cx) and the dark web via Tor-accessible domains, maintaining at minimum four separate domains at the time of its shutdown. According to blockchain analytics firm Elliptic, eXch was formally registered in Belize as Private Project Facilitators LTD (BC No. 176168). Belize prohibits virtual asset activities under Section 81(1) of the Financial Services Commission Act (2023), making eXch's operation legally questionable even under its own jurisdiction of registration. The platform openly advertised on criminal underground economy forums that it implemented no AML measures and stored no user data. eXch publicly boasted of rejecting every law enforcement subpoena received since its 2014 launch, at one point sarcastically claiming customer data had been 'lost in a boating accident' in response to a subpoena. In November 2023, the platform publicly posted and rejected subpoenas from New York State and other agencies. The exchange also made donations to open-source privacy projects including the Tor Project, Tornado Cash legal defense funds, and the encrypted messaging service SimpleX, portraying itself as a privacy-rights advocate.","heading":"Platform Overview and Business Model","sources":[],"severity":"medium"},{"content":"On February 21, 2025, North Korea's Lazarus Group executed the largest cryptocurrency theft in history, stealing approximately $1.46 to $1.5 billion in Ethereum from the Dubai-based exchange Bybit. On-chain analyst ZachXBT alleged on February 22, 2025 that eXch had facilitated the laundering of approximately $35 million from the Bybit hack proceeds within hours of the theft. Blockchain security firm SlowMist reported significant ETH-to-other-cryptocurrency conversions occurring on eXch's platform in the immediate aftermath of the hack. Researcher Nick Bax from the Security Alliance estimated the exchange had processed nearly $30 million in transactions connected to Lazarus Group. Blockchain analytics firm Elliptic, in a subsequent deep-dive investigation, raised the total estimate of Bybit funds laundered through eXch to approximately $200 million — representing roughly 14% of the total stolen amount. TRM Labs corroborated the Bybit link, noting that North Korean state-linked actors deposited and withdrew funds through eXch's mixed-pool infrastructure simultaneously with other criminal actors. eXch initially denied involvement in large-scale laundering, acknowledging only that a 'small portion' of stolen funds passed through the platform, attributing this to a 12-hour data lag in its third-party AML screening provider. The platform refused to freeze any hack-linked addresses. In one documented on-chain error, ZachXBT identified that the eXch team mistakenly sent 34 ETH (approximately $96,000) originating from Lazarus Group hack proceeds to a hot wallet at a different exchange.","heading":"Bybit Hack and Lazarus Group Laundering","sources":[],"severity":"medium"},{"content":"eXch's exposure to illicit funds predated the Bybit hack by years. According to Elliptic's investigation, the platform was used to launder proceeds from the FixedFloat exchange hack in February 2024, which resulted in approximately $26 million in stolen Bitcoin and Ethereum — eXch responded 'No' when contacted by IRS investigators regarding that incident. The platform also processed funds linked to the 2017 Parity Wallet exploit ($17.7 million) and a BitBrowser hack ($400,000). Approximately $7 million from three major drainer operations — Inferno Drainer, Pink Drainer, and Venom Drainer — passed through eXch. TRM Labs identified that eXch had been directly exposed to over $300,000 in funds linked to child sexual abuse material (CSAM) payment networks, with one vendor routing over 71% of their crypto payments through the platform, allegedly facilitating more than 6,000 individual CSAM purchases. TRM Labs noted that CSAM payment flows and North Korean state-linked hack proceeds were deposited and withdrawn through eXch's pooled infrastructure simultaneously, with CSAM payments effectively providing liquidity for state-sponsored laundering operations. The platform's mixed-pool architecture — pooling identical tokens from multiple depositors before disbursing to recipients — was specifically designed to fragment transaction traceability across multiple blockchains, functioning in a manner analogous to a cryptocurrency mixer.","heading":"Prior Criminal Activity and Broader Exposure","sources":[],"severity":"medium"},{"content":"On April 17, 2025, eXch operators announced an unexpected May 1, 2025 shutdown, citing awareness of an 'active transatlantic operation' targeting the platform's infrastructure and potential money laundering and terrorism financing charges against its team. The operators' announcement went through several reversals: on March 31, 2025 they had announced a planned merger and relocation, and on April 27 briefly announced an accelerated premature shutdown before reverting to the May 1 date on April 28. On April 30, 2025 — one day before the announced shutdown — Germany's Federal Criminal Police Office (BKA) and Frankfurt's public prosecutor's office (internet crime branch) executed the takedown, seizing eXch's server infrastructure and removing all four known clearnet and dark web domains. The seizure was announced publicly on May 9, 2025. Assets confiscated included approximately €34 million (roughly $38.25 million USD) in Bitcoin, Ether, Litecoin, and Dash, plus over 8 terabytes of data — making it the third-largest digital asset seizure in BKA history. The Dutch Fiscal Information and Investigation Service (FIOD) participated in the joint international operation. German authorities opened investigations on charges of commercial money laundering, operating a criminal online trading platform, and violations of know-your-customer regulations. No individual operators were publicly named as suspects in available reporting at time of publication. The BKA stated the data seized was expected to aid multiple parallel cybercrime investigations. Despite the infrastructure seizure, TRM Labs observed that eXch maintained API access for business partners — including mixers and privacy services — and on-chain activity consistent with mixed-pool laundering continued as late as April 30, 2025.","heading":"Law Enforcement Action and Shutdown","sources":[],"severity":"medium"},{"content":"eXch's regulatory posture was one of deliberate, documented non-compliance. The platform publicly rejected every law enforcement inquiry received since its 2014 launch, including subpoenas from New York State, IRS inquiries related to specific hacks, and other enforcement requests. The exchange registered in Belize — a corporate secrecy jurisdiction — under a generic corporate name (Private Project Facilitators LTD) despite virtual asset services being prohibited in Belize under the 2023 Financial Services Commission Act. The platform also issued an 'open demand letter' in January 2025 threatening Elliptic and other blockchain analytics firms over what it characterized as 'discriminatory' high-risk designations, shortly before the Bybit hack occurred. The FIOD's public statement on the shutdown noted: 'Privacy is not the problem — criminal misuse is.' On May 1, 2025, eXch's former management transitioned to consulting roles as new operators nominally took over, reportedly recommending a shift to dedicated liquidity pools — an arrangement that blockchain analysts assessed as an attempt to obscure continuity with the prior operation.","heading":"Regulatory and Compliance Posture","sources":[],"severity":"medium"}],"timeline":[{"date":"2014","event":"eXch launched as a no-KYC instant cryptocurrency swap service, registered in Belize as Private Project Facilitators LTD.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit","date_original":"2014-01-01"},{"date":"2017","event":"eXch allegedly processed funds linked to the Parity Wallet exploit ($17.7 million stolen).","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit","date_original":"2017-01-01"},{"date":"2023-11","event":"eXch publicly posted and rejected subpoenas from New York State and other agencies, publicly boasting of zero compliance with law enforcement since launch.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit","date_original":"2023-11-01"},{"date":"2024-02","event":"FixedFloat exchange hacked for $26 million; eXch allegedly processed laundered proceeds and refused IRS cooperation on the investigation.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit","date_original":"2024-02-01"},{"date":"2025-01-15","event":"eXch issued an open demand letter threatening Elliptic and other blockchain analytics firms over high-risk designations of the platform.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2025-02-21","event":"Bybit exchange hacked by Lazarus Group (North Korea) for approximately $1.46-1.5 billion in Ethereum — the largest crypto theft in history.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/north-korean-hackers-linked-to-15-billion-bybit-crypto-heist/"},{"date":"2025-02-22","event":"On-chain analyst ZachXBT alleged eXch laundered approximately $35 million of Bybit hack proceeds within hours of the theft; eXch's ETH reserves were observed spiking.","source":"","source_url":"https://www.theblock.co/post/342871/non-kyc-exchange-exch-denies-money-laundering-allegations-as-eth-reserves-spike-following-bybit-hack"},{"date":"2025-03-31","event":"eXch announced a planned merger and infrastructure relocation, citing alleged attacks on its systems.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2025-04-17","event":"eXch announced it would shut down on May 1, 2025, citing awareness of an 'active transatlantic operation' targeting the platform and potential terrorism financing charges.","source":"","source_url":"https://decrypt.co/315331/crypto-exchange-exch-shutting-down-following-links-to-lazarus-bybit-hack"},{"date":"2025-04-30","event":"Germany's BKA and Frankfurt prosecutors executed the eXch takedown one day before the announced shutdown, seizing all server infrastructure and removing clearnet and dark web domains.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/germany-takes-down-exch-cryptocurrency-exchange-seizes-servers/"},{"date":"2025-05","event":"eXch's announced shutdown date; former management transitioned to consulting roles as nominal new leadership took over.","source":"","source_url":"https://www.trmlabs.com/resources/blog/exch-remains-active-despite-shutdown-how-the-bybit-hack-linked-exchange-continues-to-enable-laundering-of-csam-funds","date_original":"2025-05-01"},{"date":"2025-05-05","event":"TRM Labs published findings that eXch continued offering API access to business partners post-shutdown, with on-chain activity consistent with laundering operations still observed.","source":"","source_url":"https://www.trmlabs.com/resources/blog/exch-remains-active-despite-shutdown-how-the-bybit-hack-linked-exchange-continues-to-enable-laundering-of-csam-funds"},{"date":"2025-05-09","event":"BKA and Frankfurt prosecutor publicly announced the eXch seizure: approximately €34 million ($38.25M) in BTC, ETH, LTC, and DASH confiscated, plus 8TB of data — the third-largest crypto asset seizure in BKA history.","source":"","source_url":"https://thehackernews.com/2025/05/germany-shuts-down-exch-over-19b.html"}],"sources_used":[],"source_tags":["etherscan","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:05:01.002379+00:00","updated_at":"2026-08-29T01:35:53.483+00:00"}}