Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in section: On-Chain Evidence

   “was shut down by German authorities (Frankfurt am Main Public Prosecutor's Office, ZIT, and the BKA) on April 30, 2024”

   reviewerGerman authorities shut down eXch on April 30, 2024The eXch takedown was 30 April 2025, not 2024. The page's own mention of the Bybit hack (Feb 2025) is inconsistent with a 2024 date. Not fetched directly, taken from search result summaries across several outlets.
   Proposed correction (not yet applied)

   was shut down by German authorities (Frankfurt am Main Public Prosecutor's Office, ZIT, and the BKA) on April 30, 2025
   citedcointelegraph.com/news/germany-seizes-38…hack-linked-exch
2. #2[disputed][awaiting moderator]in the timeline

   “2024-04-30”

   reviewerTimeline: eXch shutdown dated 2024-04-30Same year error as in the On-Chain Evidence section. The entry also sits before the June 2024 resumption, so moving it to 2025 changes the order of the timeline.
   Proposed correction (not yet applied)

   2025-04-30
3. #7[disputed][awaiting moderator]in section: Risk Assessment

   “FixedFloat resumed operations approximately two months after the February 2024 breach”

   reviewerResumed about two months after the February breachThe page's own timeline puts the resumption in June 2024, which matches the April-based reading. Confidence is moderate because I read only a search summary of the press release.
   Proposed correction (not yet applied)

   FixedFloat resumed operations approximately two months after the April 2024 breach
   citedcoinpedia.org/press-release/fixedfloat-e…re-enhancements/

No source the reviewer could reach confirms or contradicts the claim.

1. #5[unverifiable][awaiting moderator]in section: Team & Anonymity

   “The platform's decision to provide post-breach information 'only privately to journalists' rather than through public disclosure further limits independent accountability assessment.”

   reviewerFixedFloat provided post-breach information 'only privately to journalists'The quoted phrase is not in the cited source. The same section also says the statement was public, so the claim conflicts with the page's own sourcing.
   citedff.io/en/blog/news/reasons-for-hacking
2. #10[unverifiable][awaiting moderator]in section: Risk Assessment

   “Community review platforms document recurring reports of funds frozen under AML review without clear timelines, inadequate support communication, and in some cases allegations of unresolved freezes lasting months.”

   reviewerBeincrypto, Trustpilot and kycnot.me sources behind risk, complaints and jurisdiction claimsBeincrypto returned 403 and Trustpilot was not read. The claim is not scored.
   citedwww.trustpilot.com/review/ff.io

The cited evidence supports part of the claim but not all of it.

1. #3[partially supported][awaiting moderator]in section: On-Chain Evidence

   “Investigators seized approximately 34 million euros ($38.5 million) in crypto assets and identified eXch's role in laundering funds from the FixedFloat hacks, the Bybit hack, the Genesis creditor theft, and other major incidents.”

   reviewerGerman authorities identified eXch's role in laundering FixedFloat hack fundsThe seizure amount (about EUR 34 million) is correct. Attributing the FixedFloat link to the investigators overstates it, because the link comes from analysts such as PeckShield and ZachXBT. The summary's wording 'shut down by German authorities for laundering proceeds from major crypto thefts' has the same problem.
   citedwww.elliptic.co/blog/the-rise-and-fall-o…tolen-from-bybit
2. #6[partially supported][awaiting moderator]in section: The Hacks

   “The platform entered maintenance mode for approximately two months.”

   reviewerFirst breach caused maintenance mode of about two monthsThe two-month suspension follows the April breach. The Risk Assessment line 'resumed operations approximately two months after the February 2024 breach' conflicts with the June 2024 timeline entry and is likely wrong.
   citedff.io/en/blog/news/reasons-for-hacking

The cited evidence supports the claim as written.

1. #4[confirmed][no action needed]in section: The Hacks

   “By March 31, the attacker achieved unauthorized access across all of FixedFloat's Time4VPS-hosted servers.”

   reviewerBoth breaches attributed to Time4VPS vulnerabilities; attacker timeline Mar 31 and Apr 1; email changed; insider possibleThe primary source matches. The insider point is accurate but the page drops FixedFloat's stated preference for carelessness.
   citedff.io/en/blog/news/reasons-for-hacking
2. #8[confirmed][no action needed]in section: The Hacks

   “Attackers drained 409.304 BTC (approximately $21 million at the time) and 1,728.48 ETH (approximately $4.85 million), totaling roughly $26.1 million.”

   reviewerFeb 16 2024 hack: 409.304 BTC and 1,728.48 ETH, about $26.1M, FixedFloat confirmed on Feb 18, eXch and small flows to HitBTC and CoinSpotAmounts and the eXch routing are confirmed. The 'nine transactions' and '45 minutes' details are not in Decrypt. The Halborn and Medium analyses were not fetched.
   citeddecrypt.co/218077/fixedfloat-hack-26-mil…bitcoin-ethereum
3. #9[confirmed][no action needed]in section: The Hacks

   “Approximately $2.8 million in digital assets was stolen from FixedFloat's Ethereum hot wallet”

   reviewerSecond breach on April 1 2024 of about $2.8M; Cyvers alert April 2; Tether froze about $400kSupported by multiple search-result summaries. The cited pages were not individually fetched. The timeline's 'Second breach' entry carries date '2024-04' with original 2024-04-01, which is acceptable.
   citedcryptoslate.com/fixedfloat-reportedly-su…-from-attackers/