German law enforcement has seized 34 million euros ($38 million) in cryptocurrency from eXch, a cryptocurrency platform allegedly used to launder stolen funds during Bybit’s record-breaking $1.4 billion hack.

The seizure, announced on May 9 by Germany’s Federal Criminal Police Office (BKA) and Frankfurt’s main prosecutor’s office, involved multiple crypto assets, including Bitcoin (BTC), Ether (ETH), Litecoin (LTC) and Dash (DASH). The move marks the third-largest crypto confiscation in the BKA’s history.

The authorities also seized eXch’s German server infrastructure with extensive over eight terabytes of data and shut down the platform, the announcement added.

eXch exchanged crypto without AML

In the statement, the BKA described eXch as a “swapping” service that allowed users to exchange various crypto assets without implementing Anti-Money Laundering (AML) measures.

The platform operated since 2014 and reportedly facilitated an estimated $1.9 billion in crypto transfers, some of which are believed to be of “criminal origin,” including assets laundered during the Bybit hack.

image
Example flow of Bybit Exploit funds moving through eXch and bridging back and forth between Ether and Bitcoin. Source: TRM Labs

“Among other things, a portion of the $1.5 billion stolen from the Bybit crypto exchange, which was hacked on February 21, 2025, is said to have been exchanged via eXch,” the authorities wrote.

Multisig, FixedFloat among laundering cases

According to a post by crypto sleuth ZachXBT, eXch was also involved in laundering millions of funds from other crypto thefts and exploits, including Multisig, FixedFloat and the $243 million Genesis creditor theft.

Those are in addition to “countless phishing drainer services over the past few years with refusal to block addresses and freeze orders,” ZachXBT stated.

Germany, AML, Crimes, Hacks, Policy, Bybit
Source: ZachXBT

ZachXBT was among the first security analysts to report on eXch’s links to laundering $35 million of crypto assets stolen from Bybit soon after the hack was confirmed on Feb. 21, 2025.

Related: Hacken CEO sees ‘no shift’ in crypto security as April hacks hit $357M

“Lazarus Group transferred 5K ETH from the Bybit Hack to a new address and began laundering funds via eXch (a centralized mixer) and bridging funds to Bitcoin via Chainflip,” ZachXBT wrote in a Telegram post on Feb. 22.

eXch announced termination of services by May 1

After initially denying involvement in laundering funds from the Bybit hack, eXch eventually announced it would cease operations by May 1 in a Bitcoin Talk post published in mid-April.

“Even though we have been able to operate despite some failed attempts to shut down our infrastructure […], we don’t see any point in operating in a hostile environment where we are the target of SIGINT [Signals Intelligence] simply because some people misinterpret our goals,” it wrote.

Addressing the seizure, Benjamin Krause, the senior public prosecutor, stressed the importance of action against “quick and anonymous opportunities for money laundering for any amount.”

“Crypto swapping is an essential component of the underground economy, used to conceal incriminated funds from illegal activities such as hacking or trading in stolen payment card data, thus making them available to perpetrators,” he stated.

Magazine: Finally blast into space with Justin Sun, Vietnam’s new national blockchain: Asia Express