Germany seizes $38M in crypto from Bybit hack-linked eXch exchange
German law enforcement seized 34 million euros ($38 million) in cryptocurrency from eXch, a cryptocurrency platform allegedly used to launder funds stolen after Bybit’s record-breaking $1.4 billion hack.
The seizure, announced on May 9 by Germany’s Federal Criminal Police Office (BKA) and Frankfurt’s main prosecutor’s office, involved multiple crypto assets, including Bitcoin (BTC), Ether (ETH), Litecoin (LTC) and Dash (DASH). The move marks the third-largest crypto confiscation in the BKA’s history.
The authorities also seized eXch’s German server infrastructure with over eight terabytes of data and shut down the platform, the announcement added.
*eXch exchanged crypto without AML*
In the statement, the BKA described eXch as a “swapping” service that allowed users to exchange various crypto assets without implementing Anti-Money Laundering (AML) measures.
The platform had operated since 2014 and reportedly facilitated about $1.9 billion in crypto transfers, some of which were believed to be of “criminal origin,” including assets laundered during the Bybit hack.
Example of flow of Bybit exploit funds moving through eXch and bridging back and forth between Ether and Bitcoin. Source: TRM Labs
“Among other things, a portion of the $1.5 billion stolen from the Bybit crypto exchange, which was hacked on Feb. 21, 2025, is said to have been exchanged via eXch,” the authorities wrote.
*Multisig, FixedFloat among laundering cases*
According to a post by crypto sleuth ZachXBT, eXch was also involved in laundering millions of funds from other crypto thefts and exploits, including Multisig, FixedFloat and the $243 million Genesis creditor theft.
Those were in addition to “countless phishing drainer services over the past few years with refusal to block addresses and freeze orders,” ZachXBT said.
Source: ZachXBT
ZachXBT was among the first security analysts to report on eXch’s links to laundering $35 million of crypto assets stolen from Bybit soon after the hack was confirmed.
*Related: **Hacken CEO sees ‘no shift’ in crypto security as April hacks hit $357M*
“Lazarus Group transferred 5K ETH from the Bybit Hack to a new address and began laundering funds via eXch (a centralized mixer) and bridging funds to Bitcoin via Chainflip,” ZachXBT wrote in a Telegram post on Feb. 22.
*eXch announced termination of services by May 1*
After initially denying involvement in laundering funds from the Bybit hack, eXch eventually announced it would cease operations by May 1 in a Bitcoin Talk post published in mid-April.
“Even though we have been able to operate despite some failed attempts to shut down our infrastructure [...], we don’t see any point in operating in a hostile environment where we are the target of SIGINT [Signals Intelligence] simply because some people misinterpret our goals,” it wrote.
Addressing the seizure, senior public prosecutor Benjamin Krause stressed the importance of action against “quick and anonymous opportunities for money laundering for any amount.”
“Crypto swapping is an essential component of the underground economy, used to conceal incriminated funds from illegal activities such as hacking or trading in stolen payment card data, thus making them available to perpetrators,” he said.*Magazine: **Finally blast into space with Justin Sun, Vietnam’s new national blockchain: Asia Express*