Elliptic

eXch (exch.cx) was a no-KYC instant cryptocurrency swap service operating from 2014 until its forced shutdown in May 2025. Registered in Belize under the name Private Project Facilitators LTD, the platform processed an estimated $1.9 billion in total volume, deliberately advertising its absence of anti-money laundering controls on criminal underground forums. German federal law enforcement seized approximately $38 million in cryptocurrency assets and 8 terabytes of data from the platform in April 2025, following evidence linking eXch to laundering roughly $200 million of funds stolen in the $1.46 billion Bybit hack carried out by North Korea's Lazarus Group.

[MERGED] Consolidated into /mixin-network on 2026-10-26. This page's content is preserved in its history.

WazirX is an Indian cryptocurrency exchange, operated by Zanmai Labs Pvt Ltd under Singapore-registered parent Zettai Pte Ltd, that lost approximately $234.9 million in a July 2024 multisig-wallet exploit later attributed by the governments of the United States, Japan and South Korea to North Korea's Lazarus Group. Beyond the hack itself, the exchange carries a long record of own-conduct risk: a disputed Binance ownership relationship that has complicated victim recovery, a public attribution fight with its former custody provider Liminal, repeated Indian Enforcement Directorate FEMA and money-laundering actions since 2021, and a 15-month freeze on user funds that ended only after a Singapore court approved a revised restructuring plan in October 2025. A Supreme Court of India petition seeking a criminal probe of WazirX's founder was dismissed in April 2025 on jurisdictional grounds, leaving most liability questions unresolved.

CoinEx is a centralized cryptocurrency exchange that suffered a major hot wallet breach on September 12, 2023, with losses estimated between $54 million and $70 million across multiple blockchains. On-chain investigators ZachXBT and Elliptic attributed the attack to the Lazarus Group (TraderTraitor), a North Korean state-sponsored threat actor, based on wallet address overlap with the contemporaneous Stake.com hack. Stolen proceeds were subsequently laundered in part through the Sinbad Bitcoin mixer, which was sanctioned by the U.S. Treasury's OFAC on November 29, 2023.