Law Enforcement Action

eXch (exch.cx) was a no-KYC instant cryptocurrency swap service operating from 2014 until its forced shutdown in May 2025. Registered in Belize under the name Private Project Facilitators LTD, the platform processed an estimated $1.9 billion in total volume, deliberately advertising its absence of anti-money laundering controls on criminal underground forums. German federal law enforcement seized approximately $38 million in cryptocurrency assets and 8 terabytes of data from the platform in April 2025, following evidence linking eXch to laundering roughly $200 million of funds stolen in the $1.46 billion Bybit hack carried out by North Korea's Lazarus Group.

The Democratic People's Republic of Korea (DPRK), operating primarily through state-sponsored hacking units designated as the Lazarus Group, TraderTraitor, and APT38, has stolen an estimated $6.75 billion in cryptocurrency since 2016 across dozens of major exploits. These operations are attributed by the FBI, OFAC, CISA, and allied governments to North Korea's Reconnaissance General Bureau and are conducted to fund the regime's weapons of mass destruction and ballistic missile programs in circumvention of international sanctions. DPRK-linked hackers are responsible for the largest single crypto theft in history — the $1.5 billion Bybit hack in February 2025 — and continue to operate at unprecedented scale and sophistication.

BlackSuit is a ransomware-as-a-service (RaaS) operation that emerged in May 2023 as a rebranding of the Royal ransomware gang, itself a successor to the Conti cybercrime syndicate believed to be operated by Russian-speaking threat actors. The group employed double-extortion tactics across critical infrastructure sectors including healthcare, automotive, education, and government, compromising over 450 U.S. victims and demanding more than $500 million in ransom, primarily in Bitcoin, before international law enforcement dismantled its infrastructure in July 2025 under Operation Checkmate.

WazirX is an Indian cryptocurrency exchange, operated by Zanmai Labs Pvt Ltd under Singapore-registered parent Zettai Pte Ltd, that lost approximately $234.9 million in a July 2024 multisig-wallet exploit later attributed by the governments of the United States, Japan and South Korea to North Korea's Lazarus Group. Beyond the hack itself, the exchange carries a long record of own-conduct risk: a disputed Binance ownership relationship that has complicated victim recovery, a public attribution fight with its former custody provider Liminal, repeated Indian Enforcement Directorate FEMA and money-laundering actions since 2021, and a 15-month freeze on user funds that ended only after a Singapore court approved a revised restructuring plan in October 2025. A Supreme Court of India petition seeking a criminal probe of WazirX's founder was dismissed in April 2025 on jurisdictional grounds, leaving most liability questions unresolved.