Thomas Daniels
In a decisive move against cryptocurrency-related cybercrime, German authorities have seized €34 million (approximately $38 million) in digital assets from the crypto exchange eXch. The platform is alleged to have facilitated the laundering of funds stolen during the $1.5 billion Bybit hack in February 2025. This operation, announced on May 9 by the Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor’s Office, represents the third-largest crypto asset seizure in Germany’s history.
The confiscated assets include Bitcoin (BTC), Ether (ETH), Litecoin (LTC), and Dash (DASH). In addition to the digital assets, authorities dismantled eXch’s server infrastructure, securing over eight terabytes of data. The platform’s domain, as well as its clearnet and darknet interfaces, have been taken offline.
Founded in 2014, eXch operated as a cryptocurrency swapping service, enabling the exchange of digital assets without implementing Anti-Money Laundering (AML) measures or Know Your Customer (KYC) protocols. This regulatory void made it an attractive avenue for illicit financial flows. Investigators estimate that eXch processed around $1.9 billion in transactions, a significant portion of which are believed to be linked to criminal activities.
A notable part of the laundered assets originated from the Bybit breach, where approximately 401,000 ETH were stolen. Analysts reported that 5,000 ETH were funneled through eXch and subsequently converted into Bitcoin via the Chainflip protocol. The North Korean-affiliated Lazarus Group is suspected to be behind this cyberattack.
eXch has also been linked to additional major crypto crimes, including the $243 million theft involving Genesis creditors, the FixedFloat exploit, and widespread phishing scams. According to blockchain investigator ZachXBT, the platform repeatedly ignored requests to block suspicious addresses or comply with freeze orders.
Despite announcing a shutdown by May 1, eXch reportedly continued offering API services to certain partners. Intelligence firms observed ongoing on-chain activity, including transactions associated with child sexual abuse material (CSAM), even after the public closure.
Senior Public Prosecutor Benjamin Krause emphasized the importance of dismantling anonymous crypto-swapping platforms, stating that such services play a critical role in obscuring illicit funds derived from cybercrimes and financial fraud.
This enforcement action marks a significant step in international regulatory efforts to combat crypto-enabled money laundering. As digital assets gain wider adoption, regulatory bodies are intensifying their scrutiny to ensure the legitimacy and transparency of crypto financial systems.
