Germany Seizes $38M in Crypto from Bybit Hack-Linked eXch Exchange

German law enforcement has confiscated €34 million ($38 million) worth of cryptocurrency from eXch, a platform allegedly used to launder funds connected to the massive $1.4 billion Bybit hack. The operation, announced on May 9 by Germany’s Federal Criminal Police Office (BKA) and the Frankfurt public prosecutor’s office, marks the third-largest crypto seizure in the agency’s history.

Example of flow of Bybit exploit funds moving through eXch and bridging back and forth between Ether and Bitcoin. Source: TRM Labs

The seizure included multiple cryptocurrencies such as Bitcoin (BTC), Ether (ETH), Litecoin (LTC), and Dash (DASH). Alongside the assets, German authorities also dismantled eXch’s local server infrastructure, collecting over 8 terabytes of data in the process.

Described by the BKA as a “swapping” service, eXch enabled users to anonymously exchange various crypto assets without implementing required Anti-Money Laundering (AML) measures. The platform had operated since 2014, reportedly handling around $1.9 billion in crypto transactions—many believed to be of criminal origin.

Source: ZachXBT

According to official statements, eXch facilitated the laundering of a portion of the $1.5 billion stolen during the February 21, 2025 Bybit hack. Security analyst ZachXBT reported that the North Korea-linked Lazarus Group moved 5,000 ETH through eXch, further using Chainflip to bridge assets to Bitcoin.

Beyond Bybit, eXch is also alleged to have processed illicit funds from other major crypto thefts, including exploits involving Multisig wallets, the FixedFloat exchange, and a $243 million theft from Genesis creditors. ZachXBT also linked the platform to years of activity involving phishing drainer services and its refusal to comply with freeze or block orders.

Following the mounting pressure, eXch announced the shutdown of its services by May 1, 2025, citing growing surveillance and legal scrutiny. In a Bitcoin Talk post from mid-April, the platform claimed it had withstood previous shutdown attempts but no longer saw value in operating “in a hostile environment.”

Benjamin Krause, senior public prosecutor, emphasized the broader implications of the takedown: “Crypto swapping is an essential component of the underground economy, used to conceal incriminated funds from illegal activities such as hacking or trading in stolen payment card data, thus making them available to perpetrators.”

This latest seizure underscores a continued global crackdown on crypto-based money laundering and reinforces the legal pressure on platforms operating outside regulatory bounds.