In a major escalation of international law enforcement efforts targeting illicit crypto infrastructure, Germany’s Federal Criminal Police Office (BKA), in coordination with Frankfurt’s public prosecutor’s office, has seized over 34 million euros ($38 million) worth of cryptocurrency connected to the laundering of funds from the massive $1.4 billion Bybit hack that took place in February 2025.
The seized assets - comprising Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), and Dash (DASH) - were taken from eXch, a little-known cryptocurrency platform that had long operated on the fringes of the crypto economy as an anonymous swapping service. Authorities also shut down eXch’s German server infrastructure, seizing over eight terabytes of data in what they called a coordinated takedown of a key laundering gateway.
This marks the third-largest crypto seizure in German federal law enforcement history and shines a spotlight on how underregulated crypto services continue to play a central role in laundering proceeds from major hacks, exploits, and dark web activity.
eXch: A Long-Standing Crypto Mixer Operating Without Oversight
The eXch platform, which had reportedly been in operation since 2014, served as a crypto-swapping hub that allowed users to anonymously exchange various digital assets - without the implementation of know-your-customer (KYC) or anti-money laundering (AML) protocols.
Unlike centralized exchanges that are now required under European and U.S. regulations to track user activity, flag suspicious transactions, and submit reports to authorities, eXch explicitly positioned itself as a non-custodial, pseudonymous bridge between major cryptocurrencies, including privacy-oriented coins.
According to German prosecutors, the platform processed over $1.9 billion in transaction volume throughout its operational history. A significant portion of this flow, they claim, is likely linked to criminal activity, including funds from the February 2025 Bybit breach, in which hackers made off with $1.4 billion in digital assets, making it one of the largest centralized exchange exploits on record.
Forensic Links to the Bybit Hack and Other Major Exploits
Digital forensics from German authorities and independent analysts pointed to eXch as a central channel for converting and obscuring stolen crypto assets, especially in the immediate aftermath of the Bybit hack. Blockchain investigator ZachXBT, known for uncovering illicit laundering routes, was among the first to highlight eXch’s role in obfuscating over $35 million in ETH linked to the Bybit breach.
In a post shared in February, ZachXBT noted that 5,000 ETH linked to the exploit had been sent to new addresses and then laundered through eXch before being bridged to Bitcoin via Chainflip, another interoperability tool. These transactions reflected a pattern seen in other hacks, including those tied to North Korea’s Lazarus Group, though no direct attribution was confirmed.
In addition to Bybit, eXch was allegedly used to process stolen funds from other high-profile thefts, including the Multisig exploit, FixedFloat incident, and the $243 million Genesis creditor attack, according to ZachXBT and other blockchain sleuths.
The Legal Response: Infrastructure Seizure and Criminal Investigation
On May 9, German law enforcement agencies executed coordinated search and seizure operations, taking control of eXch’s backend infrastructure, which was hosted on servers based in Germany. Investigators are now combing through over eight terabytes of seized data, which may contain records of wallet addresses, communication logs, and transactional metadata that could link eXch’s operators - and their users - to criminal activity.
The BKA characterized eXch not as a legitimate financial service provider but as a tool for “crypto swapping” that enabled anonymous and fast laundering of digital assets, particularly from illicit origins. Prosecutors emphasized that this type of infrastructure presents a serious risk to financial transparency and AML enforcement.
Senior public prosecutor Benjamin Krause stated, “Crypto swapping is an essential component of the underground economy. It allows hackers, carders, and darknet actors to hide and reuse the proceeds of their crimes. Taking down these services is vital for disrupting the financial layer of cybercrime.”
Regulatory and Industry Context: Europe’s Evolving AML Landscape
The seizure comes as the European Union prepares to implement its sweeping Anti-Money Laundering Regulation (AMLR) by July 2027, which will introduce strict KYC requirements and ban privacy coins on licensed platforms. The case of eXch illustrates why EU regulators are increasingly concerned with decentralized and pseudonymous tools that fall outside existing regulatory perimeters.
Under AMLR, platforms like eXch - should they seek to operate within the EU - would be required to verify user identities, monitor wallet interactions, and share transactional data with national Financial Intelligence Units. The regulation also empowers agencies to take swift action against unregistered entities operating in or serving EU citizens.
However, enforcement remains complex. Services like eXch often function as hybrid models, routing through both centralized and decentralized networks, making jurisdictional claims difficult and enabling them to continue operations for years before facing scrutiny.
The BKA’s successful takedown signals an evolution in law enforcement capacity and cross-border collaboration. It also reflects growing pressure on regulators to proactively target illicit crypto infrastructure, rather than waiting for hacks to occur and attempting to track funds after the fact.
Anonymity vs. Compliance: The Debate Over Swapping Services
Platforms like eXch occupy a contentious space within the crypto ecosystem. On one hand, they enable greater liquidity, cross-chain interoperability, and pseudonymity - features that many users view as essential to the crypto ethos. On the other hand, they are frequently exploited by malicious actors seeking to obfuscate the origin of stolen funds.
Unlike mixers such as Tornado Cash, which rely on smart contract-based obfuscation mechanisms, eXch functioned more like a centralized mixer with no compliance controls, according to analysts. It allowed users to trade funds without registration, KYC checks, or even logs of counterparties. The seizure makes clear that even non-custodial or low-custody services are now on the radar of enforcement agencies.
The challenge for regulators lies in distinguishing privacy-enhancing technologies from criminal-enabling platforms, especially when the same infrastructure can be used by both legitimate and illicit actors.
End of the Line for eXch
Facing growing scrutiny in the aftermath of the Bybit hack, eXch publicly announced in mid-April that it would cease operations by May 1, citing increasing pressure from intelligence agencies and “hostile regulatory environments.”
In a farewell post on BitcoinTalk, the platform’s operators stated: “Even though we have been able to operate despite some failed attempts to shut down our infrastructure, we don’t see any point in operating in a hostile environment where we are the target of SIGINT simply because some people misinterpret our goals.”
The shutdown, followed by this month’s seizure, signals the effective end of eXch’s nearly decade-long operations. Yet, analysts warn that other platforms with similar functionality will likely rise to take its place - unless enforcement, regulation, and technological safeguards evolve in tandem.
Final thoughts
The eXch takedown marks another major milestone in the battle against crypto-enabled money laundering, but it also highlights the limitations of current enforcement models. Criminal actors are becoming increasingly sophisticated, relying on cross-chain bridges, decentralized exchanges, mixers, and crypto-to-crypto swaps to obscure trails and cash out.
With billions in crypto stolen annually - 2025 is already tracking one of the worst years on record - security experts say that targeting laundering infrastructure is as important as defending against the initial hacks.
This includes building better systems for real-time transaction monitoring, on-chain forensics, and regulatory coordination across jurisdictions, especially as crypto becomes more deeply embedded in the global financial system.
At the same time, a nuanced policy approach is essential. As critics of heavy-handed surveillance note, overly restrictive AML enforcement may drive legitimate projects and users into jurisdictional arbitrage, weakening both innovation and oversight.
Germany’s $38 million crypto seizure from eXch stands out not only for its size but for what it reveals about the gaps in crypto regulation and the evolving sophistication of money laundering methods. The case highlights the urgent need for coordinated, balanced responses that preserve financial integrity without undermining the foundational principles of privacy and autonomy in crypto networks.
As Europe tightens its AML frameworks and law enforcement agencies become more adept at tracing illicit funds, cases like eXch are likely to become more frequent. Yet the underlying arms race - between open finance and regulatory scrutiny - remains unresolved.