
{"id":61135,"date":"2025-04-22T14:19:04","date_gmt":"2025-04-22T14:19:04","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=61135"},"modified":"2025-04-22T14:19:04","modified_gmt":"2025-04-22T14:19:04","slug":"exch-cx-crypto-money-laundering-and-the-bybit-hack","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=61135","title":{"rendered":"eXch.cx, Crypto Money Laundering and the Bybit Hack"},"content":{"rendered":"<h4>The Bybit $1.5 billion hack brought unwanted attention to one peculiar actor embroiled in DPRK money laundering shenanigans: <strong>eXch<\/strong>.<\/h4>\n<p>Although eXch may be an unknown name to most crypto users, that\u2019s not the case for blockchain security researchers and firms. Since 2023, when tracing the obfuscated routes taken by crypto criminals post-heist, we\u2019ve observed a sharp uptick in the use of\u00a0eXch.<\/p>\n<p>The DPRK threat group behind the Bybit attack, TraderTraitor, relied on eXch to successfully launder almost $100 million\u200a\u2014\u200afunds that are now effectively untraceable.<\/p>\n<p>So what makes this discreet, somewhat decrepit centralized exchange such a key gateway for crypto money laundering?<\/p>\n<p>That\u2019s exactly what we explore in our latest crypto money laundering report.<\/p>\n<h3>eXch\u200a\u2014\u200aA Privacy Tool of European Origin(?)<\/h3>\n<h4>What is eXch and How Does it\u00a0Work?<\/h4>\n<p>EXch is an automated centralized exchange that is very primitive in its usage. It functions like OG exchanges (and has the look of one), allowing users to exchange one cryptocurrency for another, and has built a good reputation among users who wish to trade instantly.<\/p>\n<p>eXch generates a one-time address for its users, and once the required funds are transferred to this address, the purchased cryptocurrency is credited to their\u00a0account.<\/p>\n<p>Currently, it supports the following cryptocurrencies: BTC, LTC, ETH, XMR, USDT, USDC, DAI, DASH, and\u00a0BTCLN.<\/p>\n<p>Source: eXch<\/p>\n<p>eXch is a rather unassuming exchange with relatively low liquidity and trade volume. They claim not to use any third-party liquidity providers and that all their reserves belong to them and are allocated on their nodes. It is reported that tokens are manually sent to depleted cryptocurrency reserves.<\/p>\n<p>eXch openly provides a \u2018proof of reserve\u2019 of their swapable assets on their website\u2019s front page, and it can sometimes be observed\u200a\u2014\u200alike at press time\u200a\u2014\u200athat some currency reserves can drop to 0 (e.g., XMR) or come close to it, as seen with their Ethereum reserve, which is barely 2.5 ETH. To what extent this proof of reserves reflects the truth, we cannot\u00a0say.<\/p>\n<p>March 17th 2025 Capture of eXch Proof of Reserve\u200a\u2014\u200aSource:\u00a0eXch<\/p>\n<p>The rustic nature of eXch extends beyond its basic functionality, aesthetics, and mechanics, reminiscent of the pioneering crypto exchanges from a decade ago, deeply influenced by the enduring ideals of Nakamoto\u2019s Cypherpunk vision\u200a\u2014\u200aprivacy, liberty, and resistance to censorship. Back then, ensuring a crypto user\u2019s right to privacy was paramount, and KYC processes were almost nonexistent.<\/p>\n<p>In just a decade, the role of KYC in centralized exchanges has evolved drastically, to the point where no-KYC exchanges are now viewed as anomalies and treated with suspicion, accused of existing primarily to harbor criminal proceeds.<\/p>\n<p>eXch is one such exchange. It first gained traction in 2014, offering a more limited selection of cryptocurrencies, and operated until 2016, when it shut down for undisclosed reasons.<\/p>\n<p>However, it made a notable comeback in the summer of 2022, just as the crypto mixer Tornado Cash was sanctioned by OFAC for facilitating the laundering of hundreds of millions in illicit funds, including criminal proceeds belonging to North Korean state-sponsored crypto criminal threat\u00a0groups.<\/p>\n<p>Similar to its 2014 version, eXch\u2019s creator remained true to the exchange\u2019s original purpose and design, developing a platform that does not require KYC or SoF (Source of Funds), which have become standard procedures for high-profile CEXs since 2020 as part of anti-money laundering (AML) measures adopted by CEXes, driven by global regulatory pressure.<\/p>\n<p>The absence of KYC and SoF is the very first basic layer of privacy offered by eXch. The website \u2018KycNotMe,\u2019 which evaluates non-KYC platforms, rates eXch a 9 out of 10 for safety and privacy. eXch provides access via the privacy-focused Tor browser through its own onion address, with users reporting a seamless experience on\u00a0Tor.<\/p>\n<p>The platform requires no registration, offers automated refunds without KYC, operates a non-custodial wallet, and, notably for privacy-conscious users, does not require JavaScript\u200a\u2014\u200awhich can be used as a surveillance tool.<\/p>\n<p>Source: KycNotMe<\/p>\n<p>On their website\u2019s <a href=\"https:\/\/exch.cx\/tos\">Q&amp;A section<\/a>, the exchange outlines strict policies to ensure users have the anonymous and private trading experience they seek. These include not collecting metadata, using no cookies or other tracking techniques, disabling IP address logging on reverse proxies, caching servers, and backend servers, and removing ROM\/TO\/refund addresses 15 days after use, or immediately when the user clicks the \u2018delete data\u2019 button\u200a\u2014\u200ain eXch\u2019s\u00a0words.<\/p>\n<p>eXch seems to fully embrace the principle of censorship resistance, asserting that they \u2018do not discriminate or have any rejection criteria,\u2019 when it comes to their users. As a result, every individual is eligible to use the platform, and they do not consider \u2018prohibited jurisdictions.\u2019 To protect both themselves and their customers, eXch has made it impossible to detect users\u2019 locations, as they have \u2018IP logging disabled.\u2019<\/p>\n<p>But what makes eXch truly a privacy tool is its mixing nature. Although eXch labels itself as an exchange, blockchain security actors tend to classify it as a\u00a0mixer.<\/p>\n<p>It has two pools of addresses: one is a mixed pool in which sent and received transactions on the platform are combined. In eXch\u2019s own words, thanks to their P2P-like mixing approach, \u201cthere is no way to discover how many people are behind certain addresses, and traceability is extremely difficult.\u201d<\/p>\n<p>Meanwhile, in eXch\u2019s aggregated pool, transactions sent by users are collected into a single known address, which is also used for outgoing payments. This setup makes eXch\u2019s interaction with a user visible, significantly reducing\u00a0privacy.<\/p>\n<p>However, in exchange for this loss of privacy, eXch claims that its customers, who need to have their funds pass through entities with AML requirements, should be relatively safe from having their funds frozen. According to eXch, their interactions are assigned a low-risk score, and funds directly coming from or having passed through eXch at any point will not typically be flagged by most crypto exchanges, including Binance, Coinbase, Gate.io, HTX, Kraken, Gemini, OKX, KuCoin, and Poloniex.<\/p>\n<p>Opposedly, their mixed pool will have \u201chigh risks of frozen funds at major exchanges due to high risk score given by chain analysis platforms.\u201d<\/p>\n<p>In a <a href=\"https:\/\/bitcointalk.org\/index.php?action=profile;u=317557;sa=showPosts\">March 15th, 2025 press release<\/a>, the founder of eXch clearly expressed this dual\u00a0nature:<\/p>\n<p><em>\u201cWhen eXch was established, our objective was to provide a balanced solution that bridged the gap between mixers and government-regulated entities like compliant centralized exchanges (CEX). We anticipated that our approach would be appreciated, as we are neither a mixer nor a CEX that disregards user privacy.\u201d<\/em><\/p>\n<p>And as such, eXch has found its public. eXch particularly profited from the heavy regulatory pressure placed on CEXes concerning privacy coins, namely Monero and Zcash\u200a\u2014\u200athat are notoriously difficult to trace with blockchain forensics and are tools of choice for criminals, even outside the crypto spectrum. Most of those CEXes ended up being forced to ban them between 2022 and\u00a02024.<\/p>\n<p>Although centralized entities are usually not the go-to place for privacy-minded Monero buyers, eXch built itself a relatively good reputation and has seen some Monero users flocking to\u00a0it.<\/p>\n<p>The eXch shroud of privacy extends beyond its users, as its creator and possible employees are unknown to this\u00a0day.<\/p>\n<p>Neverthelss tracks left here and there, leads to believe eXch may have european\u00a0roots.<\/p>\n<h4>The European Roots of\u00a0eXch?<\/h4>\n<p>On the website\u2019s Q&amp;A page, eXch affirms that they are a company registered in Belize, country on the north-eastern coast of Central\u00a0America.<\/p>\n<p>Although that\u2019s where they have registered, it appears that\u2019s not where eXch spurted form nor where they operate\u00a0today.<\/p>\n<p>In a 2024 report titled \u201cInvestigating Hackers\u2019, Exploiters\u2019 Favorite Instant Crypto Exchange\u201d on eXch, crypto sleuth 0xFantasy reveals that while invedtigating eXch first track on forum BitcoinTalk back in 2014, they found enough proofs to allege that the eXch creator was a \u201cA male, non-native English speaker, ex-smoker, interested in privacy, cybersecurity, Porsches, and 90\u2019s era music and film, favorite game Lineage 2, and likely living in Austria (Innsbruck) or Germany.\u201d<\/p>\n<p>While digging a bit more into this, we discovered that the web hosting of the exch.cx website was in France, usually closer a server is to you, the lower the latency. That CentralNic Ltd, the company responsible for registering and managing the domain name was UK based. That the administrative and technical contact for the domain is associated with an address in Roches, Switzerland.<\/p>\n<p>Source: GrindinsoftSource: Grindinsoft<\/p>\n<p>This information suggests a high possibility that eXch could be European-based, due to the website\u2019s hosting in France and the administrative and technical contact in Switzerland, but it doesn\u2019t definitively prove it, as domain registration and web hosting can be handled by entities in different countries.<\/p>\n<p>Although here too, it could be a set of coincidence, on the contact page, language in which users could exchange with the team, outside of English list German first, than two other European languages, Spanish and Ukrainian.<\/p>\n<p><em>\u201cWhile communication in English is preferred, we speak the following languages too: German, Spanish, Russian, Ukrainian\u201d\u200a\u2014\u200aeXch<\/em><\/p>\n<p>European roots or not, eXch by its privacy enhancing design has become a tool of choice for money launderer, including DPRK threat\u00a0groups.<\/p>\n<h3>eXch: a Money Laundering Hotbed Used in the Bybit\u00a0Hack<\/h3>\n<p>EXch, by its design, ticks all the boxes for money laundering for criminally-minded entities. It ensures anonymity, offers mixing and untraceability, and provides access to the nearly untraceable cryptocurrency Monero\u00a0(XMR).<\/p>\n<p>According to Arkham data, starting in Q2 of 2024, eXch saw some degree of growth that likely made it even more attractive to criminals needing higher pool liquidity to launder massive amounts of\u00a0funds.<\/p>\n<p>Source: Arkham<\/p>\n<p>It is important to note that Arkham does not appear to account for Monero and Litecoin data and movement, which are also key liquid currencies within eXch. Therefore, this data should be viewed as an overall trend rather than precise data, primarily reflecting the movement of Bitcoin, Ethereum, DAI, USDT, and\u00a0USDC.<\/p>\n<p>Since the start of 2024, eXCh has been increasingly tracked in criminal incidents, including the $26 million Fixed Float heist in February 2024 and the $243 million Gemini phishing attack in August\u00a02024.<\/p>\n<p>And of course, the February 2025 Bybit\u00a0hack.<\/p>\n<h4>The Use of eXch in the Bybit\u00a0Hack<\/h4>\n<p>Numerous blockchain security firms and blockchain forensic specialist were able to trace back a part of the Bybit stolen fund back to eXch, in total over $94\u00a0million.<\/p>\n<p>Source: eXch<\/p>\n<p>The day after the hack, eXCh was already implicated in Bybit\u2019s fund laundering operations, with 5,000 stolen ETH laundered through it and later converted to Bitcoin via the coin swapper Chainflip.<\/p>\n<p>According to the <a href=\"https:\/\/www.elliptic.co\/blog\/bybit-hack-largest-in-history\">blockchain security firm Elliptic<\/a>, tens of millions of dollars in cryptocurrency flowed through eXch, which created a noticeable spike in daily Bitcoin trading volume following the Bybit\u00a0hack.<\/p>\n<p>Source: Elliptic<\/p>\n<p>Using the Wayback Machine, we analyzed the Proof of Reserves and 24-hour volume activity displayed on the eXch interface to study fund movements on the platform between February 21st and February 24th. February 15th was chosen as a random \u201cnormal activity day\u201d for comparison.<\/p>\n<p>What stands out immediately is the unusually high volume for Bitcoin, Ethereum, and to a lesser extent, Monero (XMR) and the unfrozen stablecoin DAI. It\u2019s important to note that eXch wasn\u2019t exclusively used by TraiderTraitor during these days, making it difficult to pinpoint exactly how they may have moved their funds. Additionally, all traces of these funds vanished during the mixing process. However, it\u2019s not out of the question that TraiderTraitor exchanged their ETH for more than Bitcoin, as XMR and DAI are often used in money laundering activities due to their privacy features.<\/p>\n<p>eXch Volume February 15th,\u00a02025eXch Volume February 21\u201322,\u00a02025eXch Volume February 22\u201323,\u00a02025eXch Volume February 23\u201324,\u00a02025<\/p>\n<p>The reason they stopped at around $94 million may have been due to the extremely low BTC reserves left on February 24th, especially if eXch did not replenish them in time. Regardless, they swapped most of the remaining stolen funds\u200a\u2014\u200aalmost $1.2 billion\u200a\u2014\u200athrough ThorChain.<\/p>\n<p>North Korean threat groups were not new to eXch. Blockchain security firm Match System, among others, reported spotting them in 2024 in several instances.<\/p>\n<p>DPRK ATP Fund flows to eXch\u200a\u2014\u200aSource: <a href=\"https:\/\/www.linkedin.com\/pulse\/attackers-using-exchcx-launder-money-series-recent-hacks-ffjze\/\">Match\u00a0System<\/a><\/p>\n<p>In response to the criminal use of its platform, eXch denied involvement, rebuffed claims, and resisted assisting Bybit.<\/p>\n<h4>Rebutal and Resistance Against Bybit\u2014 A Long Standing\u00a0Feud<\/h4>\n<p>On February 23rd, and March 15th, the eXch administrator took to the Bitcoin Talk forum to share the platform\u2019s official stance regarding the Bybit funds funneled through their\u00a0system.<\/p>\n<p><strong><em>The Denial<\/em><\/strong><\/p>\n<p>On February 23rd, they first denied being extensively used by TraiderTraitor, instead acknowledging that only an \u2018insignificant portion of funds\u2019 was processed in \u2018an isolated incident,\u2019 with any fees generated from it to be\u00a0donated.<\/p>\n<p>Source: Bitcoin\u00a0Talk<\/p>\n<p>For eXch, the discovery of tracks linking tens of millions in DPRK-tainted funds to their platform is nothing more than a byproduct of a \u2018constant attack on our exchange by a small group of people abusing their influence.\u2019<\/p>\n<p>This sentiment was reiterated in a press release published on Bitcoin Talk on March 15th,\u00a02025.<\/p>\n<p>In the release, eXch claims that after an investigation, they found the fund flows were mistakenly attributed to their platform. In reality, the transactions were linked to a new Bitcoin privacy service, which generates transactions resembling their rebalancing operations through ThorChain. Furthermore, according to them, mixers are using eXch as their backend, leading to tainted funds ending up in their mixed\u00a0pool.<\/p>\n<p>Source: Bitcoin\u00a0Talk<\/p>\n<p>This time, however, they decided to name-and-shame the \u2018small group of people abusing their influence.\u2019 In summary, they accuse notable figures such as crypto sleuth ZachXBT and Nick Bax to be \u2018wannabe-researchers,\u2019 while calling blockchain security firm Slowmist \u2018the one-man company who hates eXch most.\u2019 eXch claims that these individuals are conspiring to bring down the platform by misleading the public into thinking it is massively involved in criminal processes.<\/p>\n<p>Worse, they allege that either these individuals or members of the \u2018white hat communities\u2019 are involved in \u2018conspiracy and malicious acts committed against eXch\u2019s infrastructure in attempts to claim the Lazarus Bounty reward.\u2019 They go on to list these alleged actions in great detail, including server takeovers and penetration testing.<\/p>\n<p>Source: Bitcoin\u00a0Talk<\/p>\n<p>Wild, unbacked claims of sabotage aside, it is important to note that eXch did not offer any assistance in tracking the \u2018insignificant portion of funds\u2019 they identified, nor the funds from other mixers using eXch\u2019s backend that ended up in their mixed\u00a0pool.<\/p>\n<p>The reason for their lack of cooperation in the Bybit case, beyond denying their involvement, lies in their long-standing policy of refusing to assist in criminal cases, whether by cooperating with blockchain security firms, blockchain forensics, or law enforcement, but also due to their ongoing feud with\u00a0Bybit.<\/p>\n<p><strong><em>eXch, an Uncooperative Entity Feuding with\u00a0Bybit<\/em><\/strong><\/p>\n<p>eXch has built its reputation on refusing to assist in criminal cases. While the platform typically responds to law enforcement requests, it never provides any meaningful information that could help track down questionable entities using their services.<\/p>\n<p>eXch refuses to actively participate in hunting criminals, adhering to its commitment to censorship resistance. In this view, if \u2018code is law,\u2019 then their stance is one of \u2018laissez-faire, laissez-passer.\u2019<\/p>\n<p>Their debonair, if not outright insolent, attitude toward the misuse of their platform\u200a\u2014\u200abooping law enforcement on the nose really\u2014 has solidified eXch\u2019s reputation as a haven for crypto criminals. This has led to its widespread adoption in high-profile cases throughout 2024.<\/p>\n<p>However, there are three key factors that prevent eXch from becoming the platform of choice: a much higher level of liquidity, lower fees (as eXch is often considered on the pricey side), and an automated reserve-filling process. The current manual process can leave customers waiting for several hours, or even up to a full day, to complete a transaction.<\/p>\n<p>Despite these drawbacks, many are willing to pay the price for the convenience and safety from scrutiny eXch provides.<\/p>\n<p>Beyond its refusal to rub elbows with law enforcement, eXch would have been hard-pressed to help Bybit, given its long-standing feud with the platform.<\/p>\n<p>Really, eXch founder was (porbably) stomached at the audacity of Bybit to ask them to provide any kind of help. And the response to Bybit email asking for help shared by eXch reflected just\u00a0that!<\/p>\n<p>Source: Chain\u00a0Catcher<\/p>\n<p>The root of the feud lies in the blacklisting of eXch by Bybit, at least since 2024, when, according to eXch, the CEX addresses were labeled as \u2018high risk,\u2019 and the resulting fund freeze by Bybit caused significant issues for customers of both platforms.<\/p>\n<p>In an Open Demand Letter posted on January 15th, 2025, the eXch administrator requested that the IRS, DoJ, SEC, FBI, FDIC, FIOD, and OFAC use their \u2018institutional power to force the following companies to stop discrimination and abuse against eXch,\u2019 in accordance with \u2018anti-monopoly market\u00a0laws.\u2019<\/p>\n<p>At the top of the list of entities allegedly discriminating against eXch is Bybit, which is openly accused of \u2018artificially lowering eXch\u2019s risk score for intentional reputational influence,\u2019 and of \u2018preventing coins originating from eXch from entering their cryptocurrency wallet pools without any fair or legal ground for doing\u00a0so.<\/p>\n<p>Source: Bitcoin\u00a0Talk<\/p>\n<p>With Bybit at the top of its hit list it\u2019s hard to envision eXch conceading to help them, even if they were more flexible on tracking funds in criminal\u00a0cases.<\/p>\n<h3>Conclusion: Escalation and\u00a0Downfall<\/h3>\n<p>It seems that the accusations leveled against the white hat community and blockchain security firms caused more reputational damage within the crypto community than their non-cooperation ever did. The March press release, in particular, reads like a series of unhinged and paranoid delusions written by the eXch team themselves.<\/p>\n<p>They would have been better off sticking to their February statement and weathering the storm in silence. Especially at a time when their non-criminal user base is openly discussing abandoning the CEX due to its (unwilling) involvement with North Korean\u00a0hackers.<\/p>\n<p>For many, funds on the CEX are now tainted by criminal activity tied to the largest heist in history. Moreover, its association with North Korea could attract significant regulatory attention, particularly from US authorities. With that comes the risk of legal repercussions, similar to the fallout faced by users of Tornado\u00a0Cash.<\/p>\n<p>Had this been any other heist, eXch might have weathered the storm without much trouble. If this had happened three years ago, when privacy platforms sometimes used for criminal activities were largely left alone and not held accountable, eXch might not have even been mentioned.<\/p>\n<p>But the crypto community has evolved, embracing a new paradigm where every actor is held accountable when dragged into criminal activity, even if they were unwilling participants.<\/p>\n<p>It was clear that eXch would have to pay the price for staying true to its principles and refusing to reverse its stance on Bybit. According to Arkham data, within just two months, the exchange experienced a loss of 43 million in BTC, ETH, DAI, USDT, and USDC holdings\u200a\u2014\u200aan astounding 98% drop since the end of\u00a0January.<\/p>\n<p>Source: Arkham<\/p>\n<p>Just a week before, on March 17th, when we checked those same holdings, they were around $9\u00a0million.<\/p>\n<p>Source: Arkham<\/p>\n<p>Although Arkham, as previously mentioned, does not take into account XMR and LTC data\u200a\u2014\u200akey currencies on the platform and crucial for understanding the true health of eXch as most holdings could be in LTC and XMR\u200a\u2014\u200awe directly observed that both reserves and volumes of those currencies were at very low levels the week before this report was\u00a0written.<\/p>\n<p>Upon checking the 24h volume data provided by eXch on March 26th, we discovered that eXch had stopped providing it altogether. According to their website, the reason for its disappearance is \u2018to enhance our customers\u2019 privacy.\u2019 Instead, they will now provide \u2018monthly statistics only.\u2019<\/p>\n<p>Source: eXch.cx<\/p>\n<p>The reason provided is, at best, flimsy. It seems more likely that by renouncing this transparency, the platform aims to avoid self-involvement in criminal cases by not directly providing data to outside observers\u200a\u2014\u200asuch as when we tracked the movement of funds on eXch shortly after the hack, when it was used by TraiderTraitor.<\/p>\n<p>We also hypothesized that this latest development may have stemmed from an attempt to conceal the true, desolate state of the platform\u200a\u2014\u200awhere everything seems to be at a standstill nowadays.<\/p>\n<p>But on March 31st, the eXch founder announced major operational changes that answered this line of questioning. First, they revealed a jurisdictional merger with another company, effectively renouncing half of the company to \u201cBitcoin and privacy enthusiasts\u201d in a bid to save their hides from per-pro-secution\u200a\u2014\u200aor as they put it, to \u201creduce risks for (their) founding\u00a0team.\u201d<\/p>\n<p>Secondly, a stablecoin delisting was announced, with USDT and USDC being removed from eXch. The reason: both Circle and Tether have the ability to blacklist and freeze tokens. Only DAI will be maintained.<\/p>\n<p>Thirdly, eXch stated that they had ceased operating their static aggregation addresses for ETH and BTC liquidity, as they believe their efforts to provide transparency for users were \u201cabused\u201d by the white hat industry. Moving forward, they will conceal ETH and BTC flux in a way that ensures \u201cnobody can associate the outputs with eXch as easily as\u00a0before.\u201d<\/p>\n<p>Source: Bitcoin\u00a0Talk<\/p>\n<p>We can\u2019t say that eXch is currently at a stalemate, as they have clearly chosen their side and stuck to their guns. Since they refuse to change, only time will tell if they can win back their core customers, as well as their unsavory ones, all while managing to slip through the cracks of regulatory bodies.<\/p>\n<h3>About us<\/h3>\n<p><a href=\"https:\/\/nefture.com\/\"><em>Nefture<\/em><\/a><em> is a <\/em><strong><em>Web3 real-time security and risk prevention platform<\/em><\/strong><em> that detects on-chain vulnerabilities and protects digital assets, protocols and asset managers from significant losses or\u00a0threats.<\/em><em>Nefture core services includes <\/em><strong><em>Real-Time Transaction Security<\/em><\/strong><em> and a <\/em><strong><em>Threat Monitoring Platform<\/em><\/strong><em> that provides accurate exploits detections and fully customized alerts covering hundreds of risk types with a clear expertise in\u00a0DeFi.<\/em><em>Today, Nefture proudly collaborates with leading projects and asset managers, providing them with unparalleled security solutions.<\/em><a href=\"https:\/\/www.nefture.com\/demo\"><strong><em>Book a demo<\/em><\/strong><\/a><strong><em>\u00a0<\/em><\/strong><em>\ud83e\udd1d<\/em><\/p>\n<p><a href=\"https:\/\/medium.com\/coinmonks\/exch-cx-crypto-money-laundering-and-the-bybit-hack-dad72320c770\">eXch.cx, Crypto Money Laundering and the Bybit Hack<\/a> was originally published in <a href=\"https:\/\/medium.com\/coinmonks\">Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":"<p>The Bybit $1.5 billion hack brought unwanted attention to one peculiar actor embroiled in DPRK money laundering shenanigans: eXch. Although eXch may be an unknown name to most crypto users, that\u2019s not the case for blockchain security researchers and firms. Since 2023, when tracing the obfuscated routes taken by crypto criminals post-heist, we\u2019ve observed a [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-61135","post","type-post","status-publish","format-standard","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/61135"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=61135"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/61135\/revisions"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=61135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=61135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=61135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}