German Authorities Dismantle eXch Crypto Swapping Service in €34M Anti-Money Laundering Operation

In a sweeping law enforcement operation on April 30, 2025, German federal police successfully dismantled the crypto swapping platform "eXch," seizing its full server infrastructure and freezing digital assets valued at around €34 million.

The operation, which also involved the Dutch Fiscal Information and Investigation Service (FIOD), represents one of the Bundeskriminalamt’s (BKA) most significant cryptocurrency crackdowns to date.

The takedown resulted in the confiscation of over eight terabytes of platform data, including transaction logs and user details. Digital assets such as Bitcoin (BTC), Ether (ETH), Litecoin (LTC), and Dash (DASH) were among those secured in the raid. Authorities say the data haul will be instrumental in tracing the flow of criminal funds and uncovering wider networks of illicit financial activity.

Established in 2014, eXch marketed itself as a seamless, anonymous cryptocurrency swapping service, operating without any form of identity verification or data retention.

Promoted on both the clearnet and darknet, the platform directly appealed to users seeking to evade anti-money laundering (AML) compliance.

Investigators estimate the platform handled approximately $1.9 billion in cryptocurrency transfers since its launch. A substantial portion of these transactions is believed to be linked to illicit sources, including the notorious February 21, 2025 Lazarus Group hack of Bybit, in which $1.5 billion in Ether was stolen.

German prosecutors pursued criminal charges based on Section 261 of the Strafgesetzbuch (StGB), targeting commercial money laundering activities, and Section 15 of the Geldwäschegesetz (GwG), which enforces customer due diligence obligations for financial service providers. The operation also reflects enforcement of the European Union’s Fifth Anti-Money Laundering Directive (5AMLD), which mandates KYC measures, transaction monitoring, and reporting requirements for crypto businesses.

eXch’s overt avoidance of these legal mandates made it a prime candidate for international investigation, and the case underscores how EU member states are now responding aggressively to such threats. Cross-border collaboration proved vital in this effort. The Dutch FIOD’s intelligence regarding Bitcoin flow analysis enabled German investigators to pinpoint server locations and identify operational patterns critical to executing the seizure.

Carsten Meywirth, Director of the BKA’s Cybercrime Division, commented on the scope and significance of the operation:

“Once again, we have secured a record-breaking sum of millions in incriminated cryptocurrencies and shut down a digital money laundering platform. The scale of the incident impressively demonstrates that cybercrimes are being committed on an industrial scale. We will continue to increase the risk of loss for the underground economy with all the means at our disposal. Our goal remains to hold those responsible accountable.”

In addition to seizing the platform’s assets, authorities took control of its entire database, including detailed logs of user activity, wallet addresses, and transaction histories. Analysts anticipate that the trove of eight terabytes of information will expose a broader ecosystem of cybercriminals, from money mules to hacker collectives, who relied on eXch to clean profits from ransomware, phishing schemes, and digital heists.

The ramifications of this operation are expected to extend beyond eXch itself, with investigators already leveraging the data to pursue further prosecutions and identify related dark web platforms. Authorities expect new leads on multiple underground entities active in laundering digital proceeds across Europe and potentially further afield.

This operation builds upon previous cybercrime enforcement efforts. In 2024, “Operation Endgame,” led by the BKA in conjunction with international law enforcement, dismantled several malware operations, issued ten global arrest warrants, and conducted four provisional arrests. That same year, German authorities also shuttered 47 unregulated digital asset exchanges and seized €90 million through the ChipMixer takedown. They also disabled the illicit market Dstat.CC as part of Operation PowerOff.

Regulatory implications are becoming increasingly clear. Financial institutions and crypto service providers are now on high alert as enforcement of 5AMLD intensifies, and the Sixth Anti-Money Laundering Directive (6AMLD) approaches with stricter provisions. These include expanded definitions of laundering offences and harsher penalties.

Compliance officers across Europe are being urged to reinforce KYC frameworks, enhance due diligence protocols, and implement robust transaction monitoring. The eXch incident illustrates not only the legal risks of regulatory evasion but also the reputational damage companies may suffer by neglecting compliance.

By taking down eXch and freezing millions in crypto assets, European law enforcement has struck a serious blow to digital money laundering operations. The case serves as a stark reminder that underground financial services are increasingly within reach of coordinated international policing. As Meywirth emphasized, the message to cybercriminals is clear: “We will continue to increase the risk of loss for the underground economy with all the means at our disposal.” 

By fLEXI tEAM