eXch to Shut Down by May 1 Amid $35M Bybit Hack Laundering Allegations

Cryptocurrency exchange eXch has announced it will permanently shut down on May 1, 2025, following allegations that its platform was used to launder funds stolen in a massive hack of Bybit in February, one of the world’s largest crypto exchange. The decision comes as eXch faces scrutiny over its alleged role in processing illicit funds linked to North Korea's Lazarus Group, prompting the exchange to adopt a "cease and retreat" strategy in response to mounting legal and regulatory pressure.

The Bybit hack, which occurred on February 21, 2025, resulted in the theft of approximately $1.5 billion in ETH and ETH-related tokens, making it one of the largest crypto heist in history. Blockchain investigators, including Elliptic and Arkham Intelligence, identified the Lazarus Group, a North Korean hacking collective, as the perpetrators. The hackers exploited a security flaw during a routine transfer from Bybit's offline "cold" wallet to a "warm" wallet, siphoning over 500,000 ETH in under 30 minutes. Bybit CEO Ben Zhou confirmed the breach but assured users that the exchange's reserves, backed in customer assets, could cover the loss.

eXch, a lesser-known exchange emphasizing user privacy, came under fire after on-chain sleuth ZachXBT reported on February 22, that it had laundered $35 million of the stolen Bybit funds. In a post on his Telegram investigations group, ZachXBT alleged that eXch processed these funds and inadvertently sent 34 ETH (approximately $96,000) to another exchange's hot wallet. However, eXch vehemently denied this accusation in a February 22 statement on Bitcointalk, asserting that "all of its funds were safe" and dismissing accusations as "fear, uncertainty, and doubt (FUD)."

However, eXch admitted to processing an "insignificant portion" of the hacked funds in the statement, though it did not specify the amount. This admission, coupled with an alleged "active transatlantic operation" targeting the exchange, led to the decision to cease operations, according eXch interpretation. In its April 17 announcement, eXch's management cited an "increasingly hostile regulatory environment" as the primary reason for the shutdown, stating that continuing operations risked prosecution.

eXch's leadership emphasized its commitment to user privacy in its closure announcement, criticizing other exchanges for "abusing customers with nonsensical policies" in their anti-money laundering (AML) efforts. This stance has sparked debate within the crypto community. "If we were to look at these projects from the perspective of 'preventing money laundering and terrorism financing', any instant exchangers that screen their customer deposits using third-party APIs and appeal to nonsensical AML/KYC terms are far from preventing money laundering and terrorism. If they were serious about this, they would need to stop hiding behind shelf offshore companies and start conducting strict due diligence on every customer, which none of them do in reality," eXch stated.

The exchange's privacy-focused model, while appealing to certain users, likely contributed to its regulatory challenges. The Bybit hack funds were reportedly laundered through decentralized protocols like THORChain, with some passing through eXch and OKX's Web3 proxy. "Even under the immense pressure that the whole industry had to deal with due to the irresponsible actions of those at ByBit, Thorchain was the only decentralized protocol that resisted the pressure to implement screening mechanisms at the protocol level, proving itself to be absolutely reliable." In its statement, eXch praised Thorchain for its commitment to safeguarding user privacy, asserting that "Privacy is not a crime."

As eXch prepares to wind down operations, users are urged to withdraw funds before May 1. "Our partners will still have access to our API for a limited time, but what happens after May 1st will depend on our new management team, who will be in possession of all access to our infrastructure," eXch stated.