German authorities seized €34 million in cryptocurrency and shut down the crypto swapping service Exch, linked to money laundering including funds stolen in the 2025 Bybit hack. The operation on April 30, 2025, marks the third-largest crypto seizure in BKA history.
What Was Exch and Why Was It Targeted?
Launched in 2014, Exch operated via Exch.cx, allowing users to swap Bitcoin, Ether, Litecoin, and Dash anonymously without any anti-money laundering (AML) checks. Prosecutors allege the service advertised on darknet forums, facilitating illicit transactions. Authorities estimate that $1.9 billion in cryptocurrency flowed through Exch, including portions of the $1.5 billion stolen from Bybit in February 2025. Beyond the Bybit hack, Exch reportedly processed funds from the Multisig hack, Fixedfloat exploit, the $243 million Genesis creditor theft, and numerous phishing drainer services.
Details of the Raid and Seized Assets
The Public Prosecutor General’s Office in Frankfurt and Germany’s Federal Criminal Police Office (BKA) confiscated Exch’s servers, seizing over eight terabytes of data alongside crypto worth €34 million (at current rates). Although Exch had planned to cease operations by May 1, 2025, authorities acted preemptively, securing evidence with support from the Dutch Fiscal Intelligence and Investigation Service (FIOD). Carsten Meywirth, head of the BKA Cybercrime Division, stated: “The scale of this operation demonstrates clearly that cybercrimes are being committed on an industrial level. We will continue to raise the risks for the underground economy using every tool at our disposal.” Dr. Benjamin Krause of Frankfurt’s Central Office for Combating Internet Crime (ZIT) emphasized that crypto swapping plays a key role in laundering illegal proceeds, calling such enforcement “essential.”
Impact and Ongoing Investigations
The operators now face probes for operating a criminal trading platform and professional money laundering. Onchain investigator ZachXBT highlighted that Exch refused to block addresses or comply with freeze orders, making it a go-to tool for cybercriminals. This operation sends a strong signal to anonymous crypto services and underscores the growing determination of global regulators to dismantle crypto-enabled crime networks.