Worked example · 2025-04

eXch instant-exchange shutdown — Bybit-laundering substrate sanctions response — 2025-04 to 2025-05

Attribution: pseudonymous — no public actor attribution at OAK v0.1 cutoff.
Loss: structural — the eXch shutdown represents the loss of a non-KYC instant-exchange venue surface used as laundering infrastructure. At least ~$38M in mixed crypto assets was seized during the German law-enforcement operation (BKA / Frankfurt Public Prosecutor's Office, 2025-04-30). The shutdown is a laundering-infrastructure-disruption event rather than a victim-loss event; the loss is to the laundering operators (infrastructure seizure) and to the broader non-KYC exchange ecosystem (venue-surface contraction).
OAK Techniques observed: OAK-T7.001 (Mixer-Routed Hop) — eXch's non-KYC instant-exchange model functioned as a mixer-equivalent for the OAK-G01 / TraderTraitor cohort post-Tornado-Cash sanctions and during the eXch operating window; OAK-T7.003 (Cross-Chain Bridge Laundering) — eXch supported cross-chain swaps that integrated with the broader THORChain / cross-chain bridge laundering substrate documented at examples/2025-02-bybit-thorchain-laundering.md; OAK-T7.005 (Privacy-Chain Hops) — eXch was a load-bearing instant-swap-service venue surface for source-chain → privacy-chain conversion (XMR support without account-level KYC), the post-Binance-XMR-delisting (2024-02-20) instant-exchanger substrate that Chainalysis's [chainalysisprivacychain2024] cohort analysis characterises as the dominant T7.005 venue surface as exchange-mediated XMR access has contracted; OAK-T8.002 (Cross-Chain Operator Continuity, broadly construed) — eXch's post-shutdown API persistence (per TRM Labs reporting that the residual API continues to provide anonymisation infrastructure) is an operator-continuity-across-shutdown signal.
OAK-Gnn: OAK-G01 Lazarus Group / DPRK-attributed at the customer-cohort level — eXch was a laundering-rail substrate, not itself a Group entity; OAK records eXch as a laundering-infrastructure operator whose customer cohort included G01 and broader cybercriminal cohorts. Attribution at the eXch-operator level is pseudonymous — no named-individual indictment for the eXch operators at v0.1 cutoff; the whistleblower-driven DOJ track and the German law-enforcement seizure are the load-bearing legal-process surfaces.
Predicate: examples/2025-02-bybit.md — Bybit predicate event whose laundering-window attribution accelerated the eXch-shutdown timeline; examples/2025-02-bybit-thorchain-laundering.md — companion laundering-chain example.
Status: shutdown-with-residual-persistence. Public-facing operations announced as ceasing on 2025-05-01 per the eXch operator's own announcement; German law-enforcement seizure operation executed 2025-04-30 (one day before announced shutdown); residual API and infrastructure persistence continues to provide laundering-rail surface per TRM Labs follow-up reporting. The shutdown-with-residual-persistence pattern mirrors the Inferno Drainer (November 2023) → Angel Drainer (2024 successor cohort) handover documented at examples/2024-10-inferno-drainer-handover.md and is the canonical 2025 case of infrastructure persistence across operator-brand shutdown in the laundering-rail category.
Key teaching point: The eXch case is OAK's canonical 2025 worked example of the predicate-event-attribution → laundering-rail-shutdown detection chain. The structural-OAK observation is that the interval from predicate-event attribution to laundering-rail enforcement has compressed materially since 2022 — from 12–18 months for Tornado Cash / Sinbad to roughly two months for eXch — and that this compression reflects the maturation of forensic-provider methodology, the cross-jurisdictional law-enforcement coordination surface, and the willingness of multi-government actors (U.S. DOJ + U.S. Secret Service + German BKA + Frankfurt Public Prosecutor's Office) to execute coordinated operational action against laundering-rail operators within months of a flagship predicate event.

Summary

eXch was a non-KYC instant cryptocurrency exchange operating from approximately 2014 through 2025-05-01 that provided fast, identity-light crypto-to-crypto and crypto-to-fiat conversion across major assets (BTC, ETH, USDT, USDC, XMR, and others). Its operational profile — non-KYC, fast settlement, broad asset support, operator anonymity — placed it in the laundering-rail substrate that emerged in the post-Tornado-Cash-sanctions (August 2022) period, alongside Sinbad (sanctioned 2023-11), YoMix, Railgun, and the THORChain cross-chain bridge laundering substrate. The OAK-G01 / TraderTraitor cohort used eXch as one of multiple parallel laundering rails through 2024–2025; the Bybit predicate event (2025-02-21, see examples/2025-02-bybit.md) and its associated ~$1.4B THORChain laundering chain (see examples/2025-02-bybit-thorchain-laundering.md) routed at least ~$35M through eXch per public forensic-provider reporting.

The Bybit-attribution-and-laundering record produced sufficient pressure on eXch — including a U.S. DOJ whistleblower-driven track per the eXch operator's own announcement, a German BKA / Frankfurt Public Prosecutor's Office investigation under Section 261 StGB (money-laundering), and a transatlantic operational coordination between U.S. and German law enforcement — to drive the announced shutdown of public-facing operations on 2025-05-01. German law-enforcement executed a seizure operation on 2025-04-30 (one day before the announced shutdown), seizing approximately $38M in mixed crypto assets from eXch infrastructure, per BKA / Recorded Future reporting. TRM Labs subsequently reported that residual API access continues to provide anonymisation infrastructure for threat actors — the public-facing brand was retired but the underlying infrastructure persists in attenuated form.

For OAK's purposes the case is the canonical 2025 worked example of the laundering-rail-shutdown response to a predicate-event attribution. The detection chain ran from Bybit predicate (2025-02-21) → FBI IC3 attribution (2025-02-26) → industry-forensic-provider per-hop dollar accounting (T+0 to T+10) → DOJ whistleblower-information surface (within weeks) → German BKA seizure operation (2025-04-30) → eXch announced shutdown (2025-05-01). The compounding-attribution argument — that confirmed attribution at the predicate event accelerates law-enforcement action against laundering-rail infrastructure within months rather than years — is the structural OAK contribution.

Timeline (UTC)

When	Event	OAK ref
2014 onward	eXch begins operations as a non-KYC instant-exchange; operator anonymity from launch; fast settlement, broad asset support	(laundering-rail substrate emergence)
2022-08	OFAC sanctions Tornado Cash; the laundering-rail substrate begins shifting toward instant-exchanges, non-KYC venues, and cross-chain bridges	(substrate evolution context)
2023-11	OFAC sanctions Sinbad as Lazarus laundering rail; eXch absorbs portion of substrate demand	(substrate evolution context)
2024	OAK-G01 / TraderTraitor cohort uses eXch for partial laundering of multiple 2024 incidents; ZachXBT and Match Systems track eXch flows on-chain	T7.001 substrate utilisation
2025-02-21	Bybit predicate event (~$1.46B); see `examples/2025-02-bybit.md`	(predicate)
2025-02-21 onward (hours)	Initial post-extraction hops; ~$35M routed through eXch per ZachXBT / Match Systems / The Block reporting	T7.001 active substrate
2025-02-26	FBI IC3 PSA attributing Bybit to TraderTraitor / DPRK	G01 confirmed attribution at predicate
2025-02 to 2025-04	DOJ whistleblower information surfaces on eXch's role in Bybit laundering; German BKA opens money-laundering investigation under Section 261 StGB	(legal-process surface accumulating)
2025-04-17	eXch operator publicly announces shutdown effective 2025-05-01, citing "active transatlantic operation" against the exchange and DOJ whistleblower information	(operator-side shutdown announcement)
2025-04-30	German BKA / Frankfurt Public Prosecutor's Office execute seizure operation against eXch infrastructure; ~$38M in mixed crypto assets seized	law-enforcement seizure
2025-05-01	eXch public-facing operations cease per announced timeline	(operator-side public-facing shutdown)
2025-05 onward	TRM Labs reports residual API persistence; new operator team announced; laundering-rail surface persists in attenuated form	T8.002 operator-continuity-across-shutdown
Continuing	No named-individual indictment for eXch operators at v0.1 cutoff; downstream OFAC SDN action on eXch-equivalent successors remains an active surface	(legal-process state)

What defenders observed

Predicate-event attribution accelerates laundering-rail action by an order of magnitude. The FBI IC3 PSA at T+5 catalysed accelerated DOJ-track action on the laundering-rail operators within roughly two months — eXch announced shutdown at T+55 (relative to the Bybit predicate). The historical comparison points are Sinbad (sanctioned 2023-11, roughly 18 months after the Atomic Wallet / Axie Infinity / Horizon Bridge laundering windows) and Tornado Cash (sanctioned 2022-08, roughly 12 months after the dominant 2021 DPRK laundering windows). The acceleration from 12–18 months to roughly two months reflects the maturation of forensic-provider methodology and the cross-jurisdictional law-enforcement coordination that the FBI / OFAC / DOJ / German BKA / U.S. Secret Service have built since 2022. Contributors writing future T7.001 / T7.003 examples should expect this acceleration to persist; the public-record interval from predicate-event attribution to laundering-rail enforcement is materially shorter in 2025 than in 2022–2023.
Operator-brand shutdown is not equivalent to infrastructure retirement. The eXch shutdown announcement and the German BKA seizure removed the public-facing brand and seized a significant chunk of operating capital, but TRM Labs's follow-up reporting documents that residual API access continues to provide anonymisation infrastructure. The pattern is structurally identical to the Inferno Drainer (November 2023) → Angel Drainer (2024 successor) handover documented at examples/2024-10-inferno-drainer-handover.md: the brand retires, the infrastructure persists, the customer cohort migrates. Contributors writing future laundering-rail-shutdown examples should preserve this distinction explicitly — operator-brand shutdown is a defensive-surface signal, not a recovery-of-funds signal, and the post-shutdown infrastructure persistence is a first-class T8.002 observation.
Cross-jurisdictional coordination is the structural enabler. The transatlantic operation against eXch (per the eXch operator's own announcement) involved U.S. DOJ, U.S. Secret Service, German BKA, and Frankfurt Public Prosecutor's Office — a four-agency, two-jurisdiction coordination. The historical comparison points (Tornado Cash 2022, Sinbad 2023, Garantex 2025-03 Secret-Service action) involve similar multi-agency coordination. The defender lesson is that laundering-rail enforcement is a multi-jurisdictional process that scales with the maturity of the cross-jurisdictional coordination surface, not with the maturity of any single agency. Contributors writing future laundering-rail examples should call out the agency set explicitly; the coordination surface itself is a load-bearing observation.
Detection signal at the laundering-rail layer was forensic-provider-driven, not internal-controls-driven. eXch's own internal controls were structurally absent (non-KYC, no transaction monitoring, no SDN-list screening). The detection signal that drove the eXch shutdown came entirely from external forensic providers — ZachXBT, Match Systems, Chainalysis, TRM Labs, Elliptic — tracking on-chain flows and matching against the OAK-G01 wallet-cluster attribution. The structural lesson is that for non-KYC laundering-rail operators, defender investment in internal controls is operationally pointless because the operator's value proposition is the absence of those controls; the load-bearing detection surface is external forensic-provider tracking, and the load-bearing intervention surface is multi-agency law-enforcement coordination.

What this example tells contributors writing future Technique pages

The laundering-rail-operator entity class deserves first-class OAK cataloguing. Tornado Cash, Sinbad, eXch, YoMix, Railgun, and adjacent operators are not predicate-event entities — they are laundering-infrastructure operators whose customer cohort includes OAK-G01 and broader cybercriminal clusters. OAK v0.1 catalogues drainer-service operators (OAK-G02 / Inferno / Angel) as Group entities; the laundering-rail-operator category is structurally analogous and should be promoted to a Group-axis class in a future v0.x update. Contributors writing future laundering-rail examples should preserve the operator-brand-vs-infrastructure-persistence distinction in the same way that OAK-G02 examples preserve the Inferno → Angel handover distinction.
Predicate-event-attribution → laundering-rail-shutdown is a recurring detection-chain shape. The 2025 cohort produces three canonical instances: Bybit → eXch (this case), Bybit → THORChain operator economics signal (examples/2025-02-bybit-thorchain-laundering.md), and the broader 2024 DPRK-attributed cohort feeding the Garantex / Grinex re-designation in August 2025. Contributors writing future T7.001 / T7.003 examples should expect this detection-chain shape and should explicitly trace from predicate to laundering-rail-shutdown when the chain is on the public record.
The shutdown-with-residual-persistence pattern is the realistic ceiling for laundering-rail enforcement. The eXch shutdown removed the public-facing brand but did not retire the infrastructure; TRM Labs's follow-up reporting documents the residual API persistence. The 2024 Inferno → Angel handover is the structural precedent. Contributors writing future laundering-rail-shutdown examples should not over-claim "shutdown" — the realistic outcome is brand-retirement-plus-infrastructure-persistence, with the customer cohort migrating to successor brands or to parallel substrates within months.
Volume-routed-through-laundering-rail attribution is a load-bearing forensic signal. The ~$35M-through-eXch figure for the Bybit laundering chain is the per-rail dollar accounting that grounds the eXch-as-substrate attribution. Contributors writing future T7.001 / T7.003 examples should preserve per-rail dollar accounting at the same granularity as predicate-event dollar accounting; the per-rail volume is the structural evidence that supports laundering-rail enforcement actions.

Public references

[therecordexchgermanseizure2025] (proposed) — Recorded Future / The Record reporting on the German BKA / Frankfurt Public Prosecutor's Office seizure operation against eXch infrastructure on 2025-04-30; primary source for the ~$38M asset seizure figure and the multi-agency coordination.
[trmlabsexchresidualpersistence2025] (proposed) — TRM Labs follow-up reporting on the residual eXch API persistence post-shutdown; primary source for the operator-continuity-across-shutdown observation.
[theblockexchshutdown2025] (proposed) — The Block coverage of the eXch shutdown announcement, the DOJ whistleblower information, and the Lazarus Group laundering attribution.
[thedefiantexchshutdown2025] (proposed) — The Defiant coverage of the eXch shutdown including the Bybit-laundering linkage and the ~$35M figure.
[zachxbtbybitlaunderingexch2025] (proposed) — ZachXBT on-chain investigation thread on the Bybit-to-eXch laundering flow; primary community-record source for the per-transaction wallet-cluster attribution.
[chainalysisbybitthorchain] — Chainalysis primary forensic source for the Bybit laundering chain that includes the eXch-routed portion; cross-reference for the predicate-event-attribution chain.
[fbiic3bybit2025] — FBI IC3 PSA attributing Bybit predicate to TraderTraitor / DPRK; the upstream that the eXch enforcement action rests on.
[trilateraldprkstatement2025] — U.S.–Japan–ROK trilateral DPRK statement (2025-01-14); provides the multi-government attribution baseline that the eXch enforcement action operates within.

Discussion

The eXch case is OAK's canonical 2025 worked example of the predicate-event-attribution → laundering-rail-shutdown detection chain. The structural-OAK observation is that the interval from predicate-event attribution to laundering-rail enforcement has compressed materially since 2022 — from 12–18 months for Tornado Cash / Sinbad to roughly two months for eXch — and that this compression reflects the maturation of forensic-provider methodology, the cross-jurisdictional law-enforcement coordination surface, and the willingness of multi-government actors (U.S. DOJ + U.S. Secret Service + German BKA + Frankfurt Public Prosecutor's Office) to execute coordinated operational action against laundering-rail operators within months of a flagship predicate event.

The shutdown-with-residual-persistence outcome is the second analytically distinctive feature. eXch retired its public-facing brand on 2025-05-01 but the underlying infrastructure persists in attenuated form per TRM Labs's reporting. The pattern mirrors the Inferno → Angel handover documented at examples/2024-10-inferno-drainer-handover.md and is the canonical 2025 case of infrastructure persistence across operator-brand shutdown in the laundering-rail category. Contributors writing future laundering-rail examples should expect this pattern and should preserve the operator-brand-vs-infrastructure-persistence distinction explicitly.

For OAK's broader framework, the eXch case strengthens the argument for promoting the laundering-rail-operator category to a first-class Group-axis class in a future v0.x update. Tornado Cash (sanctioned then de-listed 2025-03 per court ruling), Sinbad (sanctioned 2023-11), eXch (shutdown 2025-05), Garantex / Grinex (re-designated 2025-08), YoMix, Railgun, and adjacent operators are structurally analogous to the OAK-G02 drainer-service category — they are commercial infrastructure operators whose customer cohort is dominated by adversarial actors and whose enforcement surface is multi-jurisdictional law-enforcement action. Cataloguing them at the Group axis would support consistent attribution language across worked examples and would surface the structural-similarity observation between drainer-service infrastructure (OAK-G02) and laundering-rail infrastructure (proposed OAK-G0x).

The taxonomy-update argument has direct downstream implications for OAK contributors. The current convention of citing eXch as adjacent infrastructure to predicate events under-represents the structural role that laundering-rail operators play in the post-extraction phase. A first-class Group-axis class would enable contributors to write per-operator worked examples (Tornado Cash, Sinbad, eXch, Garantex / Grinex) following the OAK-G02 / Inferno-Drainer template at examples/2024-10-inferno-drainer-handover.md — operator-profile rather than incident-timeline framing, with the customer-cohort attribution at the structural level and the per-customer-event references in the predicate-event examples.