German operation shuts down crypto mixer eXch, seizes millions in assets

German police have seized infrastructure belonging to the cryptocurrency platform eXch and confiscated more than $30 million worth of digital currency. 

On April 30, the internet crime branch of Frankfurt’s Public Prosecutor’s Office, along with Germany’s Federal Criminal Police Office (BKA), shut down the platform, which is believed to have been used to launder much of the funds stolen in the $1.46 billion hack of Bybit in February. 

According to a BKA release, police seized the exchange’s German server infrastructure, more than 8 terabytes of data and crypto assets worth about $38.2 million. 

The sting was hastened by eXch’s proclamation that it would be shutting down its operations on May 1 because of what an administrator called “an active transatlantic operation aimed at forcibly shutting our project down and prosecuting us for ‘money laundering and terrorism.’”

“The operators had initially announced at short notice that they would cease their service on May 1, 2025,” the BKA said. “The authorities anticipated this and secured numerous pieces of evidence and leads. Despite a short preparation time, the platform's database and the associated crypto assets were seized. 

eXch professes to be a privacy-minded exchange intent on preserving financial anonymity — a position that law enforcement and researchers say makes it ripe for money laundering.  

Immediately following the hack of Bybit, the platform accused eXch of serving as a conduit for hackers to launder the funds and requested that it freeze the funds, which was rebuffed. 

Subsequent investigations by threat researchers charted the flow of funds through eXch after the exploit by North Korea’s Lazarus Group. The blockchain research firm Elliptic estimated that more than $200 million worth of Bybit’s stolen cryptocurrency went through eXch, which said it had received an “insignificant” amount of the stolen funds. 

An eXch administrator did not immediately respond to a request for comment. 

German investigators estimate that since the service launched in 2014, cryptocurrency worth about $1.9 billion has been transferred through the exchange. Its services have been accessible on both the clearnet and the darknet.

They said they expect the findings in this operation to “also contribute to the investigation of numerous other cybercrimes.”