The German police have shut down eXch, a cryptocurrency exchange notorious for preserving financial anonymity and operating both on the regular internet and the dark web. The closure was the result of a coordinated operation by the Frankfurt Cybercrime Division and the Federal Criminal Police Office (BKA) of Germany. After 11 years of operation, eXch’s infrastructure was confiscated, marking a significant blow to a platform estimated to have handled nearly $1.9 billion in cryptocurrency transactions.
eXch was not a typical exchange. It operated without Know Your Customer (KYC) verification, allowing users to trade cryptocurrencies anonymously. This feature made it especially attractive to cybercriminals and hackers seeking to launder stolen funds. Indeed, eXch was implicated in laundering over $200 million in cryptocurrency stolen from the Bybit exchange during a high-profile hack. The North Korean-backed hacking group Lazarus was among its known users, channeling stolen assets through the platform.
Despite announcing a planned shutdown on May 1, 2025, eXch reportedly continued operating quietly after the public closure, serving a limited number of clients through its API. Security firm TRM Labs noted that the platform’s backend infrastructure remained active, providing anonymization services to threat actors even after the official shutdown. This shadow operation highlights the challenges law enforcement faces in fully dismantling such platforms.
The German authorities seized eXch’s servers, more than 8 terabytes of data, and crypto assets worth approximately €34 million (around $38 million). This seizure is one of the largest crypto asset confiscations in BKA’s history. The operation also uncovered evidence linking eXch to various cybercrimes, including money laundering and the trade of stolen payment card data.
eXch’s origins trace back to 2014, initially promoted on BitcoinTalk forums as an automatic exchange service for Bitcoin and other digital assets. Over time, it evolved into a hub for illicit activity, attracting notorious “drainer” services that specialized in large-scale cryptocurrency theft. Its liquidity pooling system mixed deposits and withdrawals, making it difficult for investigators to trace the flow of funds.
Defended as a privacy tool
The platform’s operators defended their service as a privacy tool aimed at restoring balance in the crypto industry, criticizing anti-money laundering efforts and risk scoring APIs as government overreach. However, experts argue that eXch functioned as a financial intermediary subject to regulatory standards similar to traditional financial institutions.
The closure of eXch is hailed as a major victory for law enforcement and the crypto industry’s integrity. Yet, experts warn that malicious actors may migrate to alternative platforms like THORChain, which was also used to obscure stolen funds in the Bybit hack. eXch’s operators reportedly recommended setting up new liquidity pools and maintaining API access temporarily, leaving open the possibility of a future comeback under new management.
eXch’s story is a cautionary tale about the risks of unregulated crypto exchanges that prioritize anonymity over compliance. While the platform’s public shutdown and asset seizure mark a significant step in combating crypto-related crime, the persistence of hidden operations underscores the ongoing challenges in policing the decentralized and borderless world of cryptocurrency.
Sources:
- Escudo Digital – https://www.escudodigital.com/ciberseguridad/policia-alemana-cierra-plataforma-criptomonedas-exch_63333_102.html
- CoinTelegraph – https://es.cointelegraph.com/news/crypto-exch-signs-life-bybit-shutdown
