German Police Seize Notorious Crypto Exchange eXch

Germany's Federal Criminal Police (BKA) took a major step in cracking down on illicit financial activities by seizing the infrastructure of the notorious cryptocurrency exchange eXch. The operation, which was carried out with the assistance of the Dutch Financial Intelligence and Investigation Department (FIOD) and the German ZIT (Central Intelligence Agency), resulted in the seizure of €34 million in cryptocurrencies and 8 terabytes of data from the platform.

eXch, a crypto exchange that has been active since 2014, was known for enabling anonymous cryptocurrency swaps via clearnet and darknet, thereby allowing users to avoid Anti-Money Laundering (AML) regulations. The platform's anonymity feature made it an attractive option for individuals seeking to conceal financial flows, including those involved in illicit activities such as hacking or trading in stolen payment card data.

According to the BKA, the authorities suspect that eXch allowed laundering of approximately $1.9 billion, with users being able to transfer crypto assets worth an estimated 1.9 billion US dollars since the service's launch. The investigation also revealed that a portion of the $1.5 billion stolen from the cryptocurrency exchange Bybit, which was hacked on February 21, 2025, was exchanged via eXch.

"Users were neither required to identify themselves to the service, nor was user data stored there," reads a press release published by BKA. "Crypto swapping via eXch was therefore particularly suitable for concealing financial flows." Dr. Benjamin Krause, Chief Public Prosecutor at ZIT, added that "crypto swapping is an essential component of the underground economy, used to conceal incriminated funds from illegal activities such as hacking or trading in stolen payment card data, thus making them available to criminals."

The seizure of eXch's infrastructure marks its third-largest crypto asset seizure ever. In February 2025, a group known as Lazarus APT stole $1.5 billion from Bybit, which is considered the largest cryptocurrency heist in history. Following this high-profile hack, eXch announced that it would shut down on May 1, 2025. However, authorities acted swiftly, seizing data and crypto assets before the platform went offline.

"Recently, we received confirmation of information we had previously, thanks to some friends we have even in the state intelligence sector, that our project is the subject of an active transatlantic operation aimed at forcibly shutting our project down and prosecuting us for 'money laundering and terrorism'," eXch operators wrote on the BitcoinTalk forum. "Even though we have been able to operate despite some failed attempts to shutdown our infrastructure (attempts that have also been confirmed to be part of this operation), we don’t see any point in operating in a hostile environment where we are the target of SIGINT simply because some people misinterpret our goals."

"Starting from the date of the merger with a new management team this month, and as a result of some urgent meetings, the majority of us voted to cease and retreat instead of going against strong winds, because none of us want to cause any harm to innocent people or this forum," eXch operators continued. The platform's decision to shut down is seen as a pragmatic move, given the hostile environment in which it operates.

The seizure of eXch highlights the importance of law enforcement agencies taking action against quick and anonymous opportunities for money laundering. As Dr. Krause noted, "It is therefore all the more important that law enforcement agencies consistently take action against such quick and anonymous opportunities for money laundering of any amount and deprive criminals of the proceeds of the crime."

Follow me on Twitter: @securityaffairs and Facebook and Mastodon (SecurityAffairs – hacking, eXch crypto exchange)