Crypto swapper eXch shows signs of life after post-Bybit shutdown

eXch, a cryptocurrency exchange initially popular with hackers and money launderers, was shut down by German authorities in April 2024, seizing €34 million in crypto and eight terabytes of data. However, its closure wasn’t the end of the story. Operating without Know Your Customer (KYC) checks, eXch facilitated the movement of illicit funds for years, notably assisting the Lazarus Group, a North Korean state-sponsored hacking unit, in laundering some of the $1.4 billion stolen from Bybit.

Despite its public shutdown announcement and a claim to cease facilitating criminal activity (quickly retracted), evidence suggests eXch continued operating discreetly via API access for select partners, highlighting the challenges of fully dismantling such platforms. Security firms like TRM Labs and Trugard observed ongoing laundering activity after the official takedown, emphasizing the platform’s ability to maintain a backdoor operation.

eXch’s history dates back to 2014, initially appearing on BitcoinTalk as a Bitcoin, Perfect Money, and BTC-e voucher swapper. Its modern iteration, funded in 2022, became a central hub for various crypto drainers like Monkey Drainer, Pink Drainer, and Inferno Drainer. The platform’s anonymity, lack of KYC, and pooled liquidity system hindered investigations, making it attractive to those seeking to obscure the origin of stolen funds.

The platform’s operational structure exemplifies the difficulties of regulating decentralized entities. Its domain was registered in the UK, listed Switzerland as the admin location, hosted infrastructure in France, and had servers seized in Germany. This transnational setup further complicated enforcement efforts.

While the shutdown represents a significant victory for cryptocurrency security, experts warn that similar platforms could emerge. eXch’s farewell message, advocating for privacy and criticizing AML enforcement, highlighted the ongoing tension between privacy and security in the crypto space. The platform’s use of THORChain as a bridging protocol also raises concerns about alternative anonymization methods. The estimated $1.9 billion in crypto processed by eXch underscores the scale of the platform’s alleged criminal activity.