Crypto Exchange eXch Shutting Down Following Links to Lazarus, Bybit Hack

eXch crypto exchange will shut down operations on May 1 following links to the $1.4 billion Bybit hack and an “active transatlantic operation,” the team said Thursday.

eXch is a privacy-focused crypto exchange known for operating without typical KYC, or know-your-customer) requirementsThe closure comes amid mounting allegations that eXch was complicit in the $1.4 billion Bybit hack in February, allegedly facilitating money laundered by North Korea’s Lazarus hacker ring.

The exchange cited an “active transatlantic operation” targeting its infrastructure and potentially pursuing money laundering and terrorism charges against its team, according to an April 17 announcement.

eXch CEO Johann Roberts told Decrypt said the decision to shut down was spurred by a “verified whistleblower from the DOJ” who provided “enough real data.”

“We don’t see any point in operating in a hostile environment where we are the target of SIGINT simply because some people misinterpret our goals,” eXch wrote in the announcement.

SIGINT here refers to Signals Intelligence, a method used for intelligence gathering.

eXch will continue to provide API access to partners until May 1. After that, a new management team will determine its future operations.

Blame game

In February, the FBI linked North Korea’s infamous Lazarus Group to the Bybit incident.

Days after the hack, eXch CEO Johann Roberts responded to Decrypt’s questions regarding allegations from Elliptic, ZachXBT, and other investigative groups blaming it for processing funds, despite Bybit’s repeated requests to block the transactions.

At the time, on-chain investigators observed “an abnormal spike” in Ethereum volume through the platform immediately following the theft.

eXch initially denied those allegations. “We are not laundering money for Lazarus/DPRK,” it said.

The exchange claimed this was due to outdated data from its third-party AML screening provider, which took roughly 12 hours to update info on the hacked addresses.

eXch later acknowledged in an emailed statement to Decrypt that it had processed “vastly a minor part” from the batch of Ethereum (approximately 90,000), laundered through “multiple centralized and decentralized services” out of a total of 401,346 ETH stolen from Bybit.

eXch argued at the time that their refusal to cooperate with Bybit was due to its “direct attacks” on eXch’s reputation in the past.

Bybit did not immediately respond to Decrypt’s request for comment.

eXch also claimed that Elliptic refused them as a customer because they were a “non-KYC accountless exchange” operating to “preserve privacy” for its users.

Such a situation “reflects not only our challenges, but also broader issues within the industry, particularly the elitist policies of certain companies like Elliptic,” Roberts told Decrypt at the time.

Elliptic did not immediately respond to Decrypt’s inquiries on that matter.

For its curtain call, eXch criticized other exchanges’ AML practices as “nonsensical policies” and argued that screening mechanisms can be “easily bypassed.”

Edited by Stacy Elliott.