A total of €34 million ($38 million) in cryptocurrency was seized by German law enforcement from eXch, a crypto-swapping platform connected to the $1.4 billion Bybit hack. The seizure, which was announced on May 9, was described by authorities as the third-largest crypto confiscation in Germany’s history.
The joint operation was led by the Federal Criminal Police Office (BKA) in coordination with Frankfurt’s prosecutor’s office. More than eight terabytes of data were also seized from eXch’s servers located in Germany. As a result of this action, the platform’s operations within the country were effectively brought to a halt.
eXch was linked by authorities to the laundering of a substantial portion of the funds stolen in the Bybit hack. The breach, which took place on February 21, 2025, resulted in the theft of $1.46 billion worth of ETH. According to investigators, over 5,000 ETH were laundered through eXch by the North Korean-affiliated Lazarus Group.
How eXch Emerged as a Central Platform for Crypto Crime
Established in 2014, eXch functioned without implementing anti-money laundering (AML) protocols. Users were permitted to exchange cryptocurrencies across blockchains without undergoing identity verification. This lack of oversight made the platform appealing to criminals aiming to conceal the origins of illicit funds through token hopping, cross-chain bridges, and numerous wallet addresses.
Approximately $1.9 billion in cryptocurrency transactions were processed by eXch, according to the BKA. A significant portion of these funds is believed to have originated from illicit activities, including phishing scams and large-scale exchange breaches. Among the assets confiscated were Bitcoin (BTC), Ether (ETH), Litecoin (LTC), and Dash (DASH).
The involvement of eXch in laundering proceeds from multiple high-profile incidents was confirmed by crypto analyst ZachXBT. These events included the $243 million theft affecting Genesis creditors, exploits targeting multisig wallets, and hacks linked to FixedFloat. According to ZachXBT, the platform consistently disregarded freeze orders and issued warnings.
Although a shutdown had been publicly announced by eXch in mid-April, with operations said to end by May 1, the platform continued to be used actively. Despite its denial of ongoing activity, blockchain analytics conducted by TRM Labs revealed that the API backend had remained operational, enabling the continuation of laundering activities.
More than $300,000 in funds connected to child sexual abuse material (CSAM) were also linked to eXch by TRM. Due to the platform’s architecture, the tracing of illicit fund flows was made exceedingly difficult. This has prompted serious concern among international law enforcement agencies.
 in cryptocurrency was seized by German law enforcement from eXch, a crypto-swapping platform connected to the $1.4 billion Bybit hack.){kind=link}