eXch is a mid-sized cryptocurrency exchange that operated mostly under the radar, without the prominence of giants like Bybit, Binance, or Coinbase. The cryptocurrency exchange is known for its lax KYC (Know Your Customer) enforcement, which it offers to give users privacy and operations, allowing them to trade or withdraw large sums anonymously.
Now, eXch has announced a potential closure of operations on May 1, 2025. This decision comes amid allegations of its involvement or complicity in the massive $1.4 billion hack of Bybit reported in February 2025, which involved laundering funds through its platform.
The hack was attributed to North Korea’s infamous Lazarus Group by the Federal Bureau of Investigation (FBI). Now, investigators and blockchain analysts have traced a significant portion of stolen assets to wallets allegedly linked to eXch.
On 17 April, eXch announced that it was being targeted by a serious international investigation, which could lead to its team facing charges like money laundering or even helping to fund terrorism. This came after a whistleblower, reportedly linked to the U.S. Department of Justice, shared evidence against the exchange.
There’s also speculation that eXch either knowingly processed stolen funds or failed to enforce adequate AML (Anti-Money Laundering) measures. Although there's no official confirmation yet that eXch was directly involved, the company itself has dropped an announcement that an “active transatlantic operation” targeting its infrastructure was underway, potentially escalating to money laundering and terrorism financing charges against its team.
In response to the allegations, eXch CEO Johann Roberts stated that “We don’t see any point in operating in a hostile environment where we are the target of SIGINT simply because some people misinterpret our goals.” The word SIGINT—short for Signals Intelligence—means government or intelligence agencies actively spying on or monitoring the organization’s communications and digital activity—like emails, phone calls, or data transfers.
🔒 The Bybit Hack
The Bybit hack, one of the largest in recent history, involved unauthorized access and sweeping withdrawals from user wallets. The hack was reported in February, and a sophisticated phishing campaign and internal compromise by North Korea’s infamous Lazarus Group are believed to be at the core of the breach.
eXch initially rejected claims that it had helped launder money for Lazarus Group or North Korea, suggesting that any irregularities were due to outdated information from its third-party anti-money laundering (AML) screening provider. The exchange explained that this led to a delay of around 12 hours in updating data linked to Ethereum addresses involved in the Bybit hack.
Further inquiry uncovered that eXch had, in fact, handled a small portion of the stolen assets—around 90,000 ETH—which were moved through both centralized and decentralized platforms to obscure their origin. While this represents only a small share of the total 401,346 ETH stolen in the Bybit breach, eXch pointed to a lack of cooperation from Bybit and referenced prior "direct attacks" on its platform as factors that worsened its public image and strained ties between the two exchanges.
🛑 eXch's lax KYC contributed to the allegations
eXch implements lax KYC to its system, and when an exchange has lax KYC, it means
- It allow users trade or withdraw large sums anonymously
- It allow users accept fake or incomplete documents
- It allow users delay or skip verification entirely
- It allows users to ignore answering tough security questions about fund sources.
In essence, lax KYC creates a huge loophole for bad actors—like hackers, scammers, or money launderers—to move stolen or illicit funds without scrutiny. The lax KYC policy of eXch is indeed a key part of the investigation.
Until its closure on May 1 2025, eXch will continue providing API access to partners that rely on it infrastructure. Meanwhile, the closure will mark significant development in the ongoing debate over the role and accountability of privacy-focused exchanges in the crypto ecosystem.
