Non-KYC exchange eXch to close down under money laundering scrutiny tied to Lazarus Group

Privacy-focused crypto trading platform eXch officially announced that it will cease operations on May 1, following allegations of the platform being used as a portal for crypto money laundering by North Korea's Lazarus Group.

The exchange said in its announcement that it recently learned that it has become a subject of an active "transatlantic operation" to shut down the platform and prosecute the team for "money laundering and terrorism."

The decision to shut down the platform came after a majority of the team voted to "cease and retreat" upon the intense scrutiny.

"We don't see any point in operating in a hostile environment where we are the target of SIGINT (Signals Intelligence) simply because some people misinterpret our goals," eXch wrote.

Multiple onchain analysts previously alleged that eXch was being used by the Lazarus Group to mix and obfuscate the origin of over a billion-dollar worth of ETH stolen from Bybit on Feb. 22. 

"[eXch] has recorded an abnormal spike in ETH volume — 20K ETH in the past 24 hours versus its usual 800 ETH," blockchain analyst vxdb wrote on X, with data from the day of the Bybit hack. "Their Bitcoin reserves are also empty, but their ETH reserves have increased by 900%."

The non-KYC exchange denied such accusations at the time.

"We are not laundering money for Lazarus/DPRK," eXch wrote in a previous forum post. "[T]he opposite opinion is solely a perspective of some people that wish decentralized coins' fungibility and on-chain privacy to vanish...long-time haters of decentralized crypto in general."

In its latest announcement, eXch did not deny the presence of illicit Lazarus-linked funds on the platform but stated: "The goals we certainly never had in mind were to enable illicit activities such as money laundering or terrorism, as we are being accused of now."

Decentralization and privacy

The North Korea-backed exploit on Bybit sparked debate among crypto protocols and peer-to-peer vendors over whether upholding their decentralization ethos by refusing to block illicit funds is the right course of action.

Following Bybit's exploit, cross-chain decentralized exchange Chainflip temporarily halted its front-end swapping platform due to concerns that deploying an upgrade to prevent hackers from using the platform could compromise its decentralization.

THORChain , a cross-chain liquidity protocol that was used by Bybit hackers, also held internal debates on proposals to block Lazarus funds but ultimately decided not to adopt them.

TCB, who was a core contributor of the protocol, departed the platform as a result.

"The ethos about being decentralized are just ideas," TCB wrote. "When the huge majority of your flows are stolen funds from North Korea for the biggest money heist in human history, it will become a national security issue, this isn't a game anymore."

Meanwhile, in its Thursday announcement, eXch criticized projects that blocked certain user funds from the platform as having a "false idea" of anti-money laundering, while lauding THORChain and other privacy-focused projects for not "betraying" their mission.

"Any instant exchangers that screen their customer deposits using third-party APIs and appeal to nonsensical AML/KYC terms are far from preventing money laundering and terrorism," eXch wrote. 

The exchange then stated that if projects were serious about anti-money laundering, they should "stop hiding" behind offshore entities and conduct strict due diligence on every individual customer. It also said even after its demise, the illicit actors would still find a way to launder funds. 

"Privacy is not a crime," eXch wrote.

While the eXch announcement extensively lamented the breach of its privacy-focused vision for resisting anti-money laundering measures it deemed ineffective, it did not suggest any alternative solutions for hacks and illegal funneling of funds that continues to haunt the crypto industry.