The rise and fall of eXch – the dark service used by North Korea to launder $200 million stolen from Bybit
Contents
Around $200 million of the $1.46 billion stolen from Bybit on 21 February 2025 – nearly 15% – was sent through eXch, a no-KYC crypto exchange service. These funds are not the only proceeds of North Korean exploits, or indeed of crime more generally, that have been laundered through this service in the past.
Having been unable to escape the spotlight amid industry-wide efforts to trace the funds stolen from Bybit, eXch announced two months after the hack that it was shutting down operations, effective May 1st 2025.
Despite sustained attempts by eXch to obfuscate their on-chain activities, Elliptic has taken action to maintain comprehensive coverage of wallets associated with this entity despite their obfuscation attempts. In this blog, we explore the inner workings of this service, as well as its public refusals to prevent the laundering of hundreds of millions of dollars’ worth of sanctioned and criminal funds.
What is eXch?
EXch was …
Having been unable to escape the spotlight amid industry-wide efforts to trace the funds stolen from Bybit, eXch announced two months after the hack that it was shutting down operations, effective May 1st 2025.
Despite sustained attempts by eXch to obfuscate their on-chain activities, Elliptic has taken action to maintain comprehensive coverage of wallets associated with this entity despite their obfuscation attempts. In this blog, we explore the inner workings of this service, as well as its public refusals to prevent the laundering of hundreds of millions of dollars’ worth of sanctioned and criminal funds.
What is eXch?
EXch was …