In one of the largest crypto crackdowns in the country’s history, German authorities have seized €34 million ($38 million) in cryptocurrency from eXch, a platform allegedly used to launder funds linked to the massive Bybit hack.
Announced on May 9 by the Federal Criminal Police Office (BKA) and Frankfurt’s main prosecutor’s office, the seizure is the third-largest crypto confiscation in BKA’s records. Authorities confiscated a mix of digital assets including Bitcoin (BTC $103,101), Ether (ETH $2,337), Litecoin (LTC $97.99), and Dash (DASH $23.82).
Beyond the digital currency, law enforcement also took control of eXch’s German server infrastructure, containing over eight terabytes of data, and shut down the platform entirely.
eXch operated without AML compliance
In its statement, the BKA described eXch as a “swapping” service that enabled users to exchange crypto assets without enforcing Anti-Money Laundering (AML) protocols. Operating since 2014, the platform facilitated an estimated $1.9 billion in crypto transactions, some of which were believed to have criminal origins.
Authorities suspect that a portion of the $1.5 billion stolen from Bybit in its February 21, 2025 hack was laundered through eXch.
Links to other high-profile crypto crimes
On-chain analyst ZachXBT linked eXch to additional laundering operations involving funds from Multisig, FixedFloat, and the $243 million Genesis creditor theft. He also cited eXch’s refusal to block known phishing and scam addresses over several years.
In a Telegram post on Feb. 22, ZachXBT revealed that 5,000 ETH stolen from Bybit had been sent through eXch and converted to Bitcoin via Chainflip, a cross-chain swapping platform. The Lazarus Group, a North Korean state-affiliated hacking entity, is believed to be behind the laundering.
eXch shuts down amid investigations
Initially denying any role in the Bybit hack, eXch eventually announced it would terminate its services by May 1, citing increased pressure and surveillance. In a Bitcoin Talk forum post, eXch wrote:
Even though we have been able to operate despite some failed attempts to shut down our infrastructure, we don’t see any point in operating in a hostile environment where we are the target of SIGINT [Signals Intelligence] simply because some people misinterpret our goals.”
Prosecutor: Anonymous swapping a threat to financial security
Senior public prosecutor Benjamin Krause emphasized the broader implications of crypto-based money laundering:
Crypto swapping is an essential component of the underground economy, used to conceal incriminated funds from illegal activities such as hacking or trading in stolen payment card data, thus making them available to perpetrators.
This case marks a significant milestone in Germany’s ongoing battle against cyber-enabled financial crimes.
