German law enforcement seizes 34 million euros ($38 million) in crypto from eXch platform

The seizure, announced on May 9 by Germany's Federal Criminal Police Office (BKA) and Frankfurt's main prosecutor's office, involved multiple crypto assets

German law enforcement has seized 34 million euros ($38 million) from eXch, a cryptocurrency platform used to launder funds stolen after Bybit's record-breaking $1.4 billion hack.

Announced on May 9 by the Federal Criminal Police Office (BKA) and Frankfurt’s main prosecutor’s office, the move involved several crypto assets, including Bitcoin (BTC), Ether (ETH), Litecoin (LTC) and Dash (DASH). It marks the third-largest crypto confiscation in the BKA’s history.

The authorities also seized eXch’s German server infrastructure with over eight terabytes of data and shut down the platform, the announcement added.

eXch exchanged crypto without AML

In the statement, the BKA described eXch as a “swapping” service that enabled users to exchange various crypto assets without implementing any Anti-Money Laundering (AML) measures.

The platform had been running since 2014 and is said to have facilitated about $1.9 billion in crypto transfers, some of which were deemed to be of “criminal origin,” including assets laundered during the Bybit hack.

"Among other things, a portion of the $1.5 billion stolen from the Bybit crypto exchange, which was hacked on Feb. 21, 2025, is said to have been exchanged via eXch," the authorities wrote.

Multisig, FixedFloat among laundering cases

According to a post by crypto sleuth ZachXBT, eXch was also involved in laundering millions of funds from other crypto thefts and exploits, including Multisig, FixedFloat and the $243 million Genesis creditor theft.

Those were in addition to "countless phishing drainer services over the past few years with refusal to block addresses and freeze orders," ZachXBT said.

ZachXBT was among the first security analysts to report on eXch's links to laundering $35 million of crypto assets stolen from Bybit soon after the hack was confirmed.

"Lazarus Group transferred 5K ETH from the Bybit Hack to a new address and began laundering funds via eXch (a centralized mixer) and bridging funds to Bitcoin via Chainflip," ZachXBT wrote in a Telegram post on Feb. 22.

eXch announced termination of services by May 1

After initially denying involvement in laundering funds from the Bybit hack, eXch eventually announced it would cease operations by May 1 in a Bitcoin Talk post published in mid-April.

"Even though we have been able to operate despite some failed attempts to shut down our infrastructure[...], we don’t see any point in operating in a hostile environment where we are the target of SIGINT [Signals Intelligence] simply because some people misinterpret our goals," it wrote.

Addressing the seizure, senior public prosecutor Benjamin Krause stressed the importance of action against "quick and anonymous opportunities for money laundering for any amount."

"Crypto swapping is an essential component of the underground economy, used to conceal incriminated funds from illegal activities such as hacking or trading in stolen payment card data, thus making them available to perpetrators," he said.