Bybit Hack Triggers $38M Seizure and Shutdown of eXch in Germany

Germany Shuts Down eXch Crypto Platform Amid Probe Into $1.5 Billion Bybit Hack

German authorities have officially shut down a controversial cryptocurrency exchange, eXch, as part of an extensive criminal investigation into one of the largest digital currency heists in history. The closure follows the February 2025 hack of the Dubai-based crypto exchange Bybit, during which cybercriminals—believed to be linked to North Korea’s Lazarus Group—stole approximately $1.5 billion worth of Ethereum.

The German Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor’s Office jointly announced on Thursday that they had seized €34 million (approximately $38 million USD) in digital assets from eXch and dismantled the platform’s operations. The enforcement action marks Germany’s third-largest crypto seizure to date.

The raid, which took place on May 9, involved the confiscation of various digital assets including Bitcoin (BTC), Ethereum (ETH), Dash (DASH), and Litecoin (LTC), alongside over eight terabytes of server data believed to be crucial in uncovering further criminal activity tied to the laundering of hacked funds.

The Link Between eXch and the Bybit Hack

According to investigators and cybersecurity researchers, the eXch platform played a pivotal role in laundering the stolen Ethereum by allowing hackers to swap tokens and move funds across different blockchains in an effort to obscure their origins. This process, often involving cross-chain bridges and crypto mixers, is designed to evade law enforcement detection and bypass anti-money laundering protocols.

Prominent blockchain investigator ZachXBT was among the first to raise alarms, publicly revealing the link between the Bybit breach and transactions processed through eXch. ZachXBT’s analysis helped authorities trace the path of the stolen assets soon after the breach was discovered on February 21, 2025.

Source: ZachXBT

German authorities now believe that eXch provided essential infrastructure for the cybercriminals to launder their digital loot. Much of the activity was made possible due to the platform’s long-standing refusal to implement Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance measures.

North Korean Cybercriminal Ties

The perpetrators of the Bybit hack are suspected to be operatives from the Lazarus Group, a state-sponsored hacking collective from North Korea known for previous high-profile crypto heists. The group has been implicated in a series of attacks targeting global crypto platforms, financial institutions, and government systems.

German prosecutors allege that the hackers used eXch in combination with decentralized finance (DeFi) tools such as mixers, token bridges, and non-compliant swap platforms like Chainflip and FixedFloat. These services enabled the attackers to convert Ethereum into Bitcoin and other digital assets, making the funds nearly impossible to trace through conventional investigative methods.

Some of the stolen funds were also funneled through wallets associated with past attacks, further complicating recovery efforts. Law enforcement officials say they are now working closely with international partners to expand the scope of the investigation.

A History of Shadowy Operations

Launched in 2014, eXch operated in a legal grey area for nearly a decade, offering fast crypto swaps without user identification. The platform advertised itself as a privacy-focused exchange and was accessible via both the standard internet and the darknet, making it a favorite among cybercriminals seeking to anonymize their transactions.

Authorities estimate that eXch processed over $1.9 billion in cryptocurrency throughout its lifespan, with a significant portion now suspected of being linked to criminal enterprises including ransomware groups, scam networks, and illicit darknet markets.

Despite warnings and increasing regulatory pressure, eXch consistently ignored demands to implement safeguards. Investigators say that the platform's model of anonymity, speed, and lack of accountability enabled it to become a major hub for money laundering and the movement of stolen digital assets.

Attempted Shutdown Ahead of Police Action

Interestingly, eXch’s administrators announced in mid-April that the platform would cease operations by May 1, 2025, citing mounting regulatory scrutiny and what they claimed was unjust targeting by law enforcement agencies. The team behind eXch alleged that their intentions had been misinterpreted and that they were being singled out unfairly.

However, German police moved swiftly before the self-imposed shutdown deadline, anticipating that the platform's final days could be used to process one last batch of stolen funds. The proactive seizure of assets and data was meant to prevent any final laundering efforts and secure evidence for prosecution.

Authorities say the operation is still ongoing, with potential arrests and further seizures expected in cooperation with law enforcement agencies across Europe, Asia, and the Middle East.

A Turning Point in Crypto Law Enforcement?

The takedown of eXch signals a growing global commitment to enforcing digital asset regulations and holding non-compliant platforms accountable. Experts say the action is part of a broader trend where authorities are stepping up enforcement against entities facilitating criminal activity under the guise of decentralization and privacy.

"This is a wake-up call to any crypto business that believes it can operate without oversight," said Dr. Erik Müller, a legal analyst and digital asset compliance expert based in Berlin. "The anonymity that once defined crypto is now being challenged by an international push for transparency, and non-compliant platforms will face consequences."

He added that the crackdown also serves as a stern warning to developers and investors in the crypto space who continue to rely on unregulated services. "These tools may be fast and convenient, but if they’re being used to wash stolen money or fund terrorism, they’re a legal liability."

What’s Next for the Investigation?

As the probe expands, investigators are expected to dig deeper into the network of services used to launder the $1.5 billion stolen from Bybit. This includes analyzing transaction flows through various decentralized protocols, exchange platforms, and blockchain bridges that may have been complicit—intentionally or otherwise.

The seized server data from eXch is currently undergoing forensic analysis and is likely to yield key insights into the identities of wallet holders, transaction histories, and possibly even developer backdoors or administrative communications.

Meanwhile, Bybit has yet to release a full postmortem of the February hack, although the company has acknowledged the breach and stated that user funds would be covered. Security experts anticipate more robust measures being introduced by centralized exchanges following the incident.

Industry Response

The crypto industry is watching the situation closely. Several centralized and decentralized platforms have already begun reviewing their own compliance protocols in light of recent enforcement actions. Financial regulators from other jurisdictions, including the United States, Singapore, and South Korea, have also expressed interest in coordinating on cross-border investigations.

"This may just be the start," said Müller. "The technology that enabled decentralized finance is powerful, but in the wrong hands, it can become a serious threat to financial stability and national security."

As governments and regulatory bodies race to close the loopholes exploited by cybercriminals, the dismantling of eXch may mark a significant shift in how digital crime is pursued—and prevented—on a global scale.

Writer @Erlin

Erlin is an experienced crypto writer who loves to explore the intersection of blockchain technology and financial markets. She regularly provides insights into the latest trends and innovations in the digital currency space.

 

 Check out other news and articles on Google News

Disclaimer:

The articles published on hokanews are intended to provide up-to-date information on various topics, including cryptocurrency and technology news. The content on our site is not intended as an invitation to buy, sell, or invest in any assets. We encourage readers to conduct their own research and evaluation before making any investment or financial decisions.

hokanews is not responsible for any losses or damages that may arise from the use of information provided on this site. Investment decisions should be based on thorough research and advice from qualified financial advisors. Information on HokaNews may change without notice, and we do not guarantee the accuracy or completeness of the content published.