Verify a decision

{"actor":"system:backfill","investigation_id":"c22d383f-c503-482c-bedc-43acc00e2689","kind":"publish","page_slug":"exch","published_at":"2026-05-19T01:06:46.826Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"eXch","sections":[{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]}],"sources_used":[],"summary":"eXch (exch.cx) was a no-KYC instant cryptocurrency swap service operating from 2014 until its forced shutdown in May 2025. Registered in Belize under the name Private Project Facilitators LTD, the platform processed an estimated $1.9 billion in total volume, deliberately advertising its absence of anti-money laundering controls on criminal underground forums. German federal law enforcement seized approximately $38 million in cryptocurrency assets and 8 terabytes of data from the platform in April 2025, following evidence linking eXch to laundering roughly $200 million of funds stolen in the $1.46 billion Bybit hack carried out by North Korea's Lazarus Group.","timeline":[{"date":"2014-01-01","event":"eXch launched as a no-KYC instant cryptocurrency swap service, registered in Belize as Private Project Facilitators LTD.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2017-01-01","event":"eXch allegedly processed funds linked to the Parity Wallet exploit ($17.7 million stolen).","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2023-11-01","event":"eXch publicly posted and rejected subpoenas from New York State and other agencies, publicly boasting of zero compliance with law enforcement since launch.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2024-02-01","event":"FixedFloat exchange hacked for $26 million; eXch allegedly processed laundered proceeds and refused IRS cooperation on the investigation.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2025-01-15","event":"eXch issued an open demand letter threatening Elliptic and other blockchain analytics firms over high-risk designations of the platform.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2025-02-21","event":"Bybit exchange hacked by Lazarus Group (North Korea) for approximately $1.46-1.5 billion in Ethereum — the largest crypto theft in history.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/north-korean-hackers-linked-to-15-billion-bybit-crypto-heist/"},{"date":"2025-02-22","event":"On-chain analyst ZachXBT alleged eXch laundered approximately $35 million of Bybit hack proceeds within hours of the theft; eXch's ETH reserves were observed spiking.","source":"","source_url":"https://www.theblock.co/post/342871/non-kyc-exchange-exch-denies-money-laundering-allegations-as-eth-reserves-spike-following-bybit-hack"},{"date":"2025-03-31","event":"eXch announced a planned merger and infrastructure relocation, citing alleged attacks on its systems.","source":"","source_url":"https://www.elliptic.co/blog/the-rise-and-fall-of-exch-the-dark-service-used-by-north-korea-to-launder-200-million-stolen-from-bybit"},{"date":"2025-04-17","event":"eXch announced it would shut down on May 1, 2025, citing awareness of an 'active transatlantic operation' targeting the platform and potential terrorism financing charges.","source":"","source_url":"https://decrypt.co/315331/crypto-exchange-exch-shutting-down-following-links-to-lazarus-bybit-hack"},{"date":"2025-04-30","event":"Germany's BKA and Frankfurt prosecutors executed the eXch takedown one day before the announced shutdown, seizing all server infrastructure and removing clearnet and dark web domains.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/germany-takes-down-exch-cryptocurrency-exchange-seizes-servers/"},{"date":"2025-05-01","event":"eXch's announced shutdown date; former management transitioned to consulting roles as nominal new leadership took over.","source":"","source_url":"https://www.trmlabs.com/resources/blog/exch-remains-active-despite-shutdown-how-the-bybit-hack-linked-exchange-continues-to-enable-laundering-of-csam-funds"},{"date":"2025-05-05","event":"TRM Labs published findings that eXch continued offering API access to business partners post-shutdown, with on-chain activity consistent with laundering operations still observed.","source":"","source_url":"https://www.trmlabs.com/resources/blog/exch-remains-active-despite-shutdown-how-the-bybit-hack-linked-exchange-continues-to-enable-laundering-of-csam-funds"},{"date":"2025-05-09","event":"BKA and Frankfurt prosecutor publicly announced the eXch seizure: approximately €34 million ($38.25M) in BTC, ETH, LTC, and DASH confiscated, plus 8TB of data — the third-largest crypto asset seizure in BKA history.","source":"","source_url":"https://thehackernews.com/2025/05/germany-shuts-down-exch-over-19b.html"}]},"v":1}