...

Deep Code

contact@decodecybercrime.com

The eXch.cx Enigma: Uncovering Its Role in High-Risk Financial Activity

The eXch.cx Enigma: Uncovering Its Role in High-Risk Financial Activity

eXch.cx, originally launched in 2014 under the domain eXch.cc, has long been associated with high-risk transactions and illicit entities. In its early years, it facilitated exchanges involving Bitcoin, Perfect Money, and BTC-e vouchers, interacting with darknet markets and OFAC-sanctioned entities. The platform abruptly ceased operations in 2016, dispersing funds across multiple exchanges and mixers. It resurfaced in 2022 under the eXch.cx domain, maintaining its no-Know-Your-Customer (KYC) policy while allegedly processing funds tied to North Korea’s Lazarus Group, various scam and hacking groups, and Russian cybercriminal networks, including Hydra Marketplace and Ransomware-as-a-Service (RaaS) operators. 0xFantasy has conducted a historical analysis of eXch.cx.

eXch.cx was registered in Belize under Private Project Facilitators LTD. They are no longer compliant under the new Belize Companies Act 2022. eXch.cx is believed to be managed by an elusive figure named “Johann Roberts”.

In February 2025, the exchange has been accused of playing a role in laundering funds from high-profile crypto hacks, such as the $1.4 billion Bybit hack, attributed to the North Korean-affiliated Lazarus Group. Blockchain analysts observed significant transfers of Ether (ETH) from wallets associated with the hack to eXch.cx, with reports indicating that the exchange processed approximately $30 million for the group on a single day. Additionally, eXch.cx’s ETH reserves reportedly spiked by 900% during this period. A substantial amount of ETH was routed through eXch.cx and converted into BTC and XMR.

The platform has refused to cooperate with exchanges to block flagged transactions, reinforcing its reputation as a hub for illegal financial activities.

Although eXch.cx’s servers are located in Switzerland, France, Sweden, and Germany there are indications that its operations are likely carried out from Germany.

In this blog article, we take a deep dive into the non-KYC exchange eXch.cx, uncovering its online presence and illicit activities. The below table provides a summary of their associated online accounts identified.

Platform Username / ID Notes
X.com _exch_ / 2533866818 Registration: May 2014

Historic website: exch[.]cc

Registered email: admin@exch.cc

Following bitcoin_de (Germany), WirtschaftsWoche (@wiwo; Düsseldorf, Germany), @manager_magazin (Hamburg, Germany)

Posted links to German websites

X.com Exchcx / 2940536305 Registration: December 2014

Website: exch.ch

LinkedIn exchcx Profile Url: linkedin.com/company/exchcx
Nostr eXch Registration: 10 December 2023

Profile Url:

primal.net/p/npub1xerpsfduwvehn32r3xh8pwfck2c93pchvshrx3dlk6ywckjaldesvhc68z

SimpleX Chat eXch N/A
Facebook eXch.cc  746915088681217 Registration: 28 August 2014

Website: exch[.]cc – historic site; no longer in use

Location: Düsseldorf, Germany

bitcointalk.org eXch / 317557 Registered: 19 April 2014, 05:55:09 PM

Last Active: 07 March 2025, 11:11:49 AM

Website: exch[.]ch

Email: support@exch.cx

Name: Johann

Business Name: Private Project Facilitators LTD / eXch

forum.bits.media eXch / 22883 Registered: 14 March 2015, 18:00

Last Visited: 7 December 2023, 15:39

F-Droid App:

f-droid.org/en/packages/io.github.pitonite.exch_cx/

Historic domain: exch[.]cc

Reddit exch Registered: 5 May 2012

Profile Url: reddit.com/user/exch/?rdt=60598

German language

codecanyon.net exch Registration: July 2021

Location: Germany

bestchange.com exch Profile Url: bestchange.com/exch-exchanger.html

Location: Germany

Delisted from monitor: 17 May 2016

altcoinstalks.com eXch / 97183 Registered: 07 December 2023, 04:12:01 PM

Last Active: 30 December 2023, 01:33:22 AM

ETH address:

0xf1da173228fcf015f43f3ea15abbb51f0d8f1123

BTC address:

bc1qu2dq8w8lv8v3l7lr2c5tvx3yltv22r3nhkx7w0

Our investigation into the official domains linked to eXch has uncovered the following infrastructure providers.

Official Domains

Domain Notes IP address / ISP
exch.cx Registrar: CentralNic Ltd

Registered: 12 July 2022

From 5 March 2024 the registrant appears to be Vincent Ritter, with the registrant address:

Hautes Roches 40, Roches, 2762, Switzerland

Email: mimetypech9813999@proton.me

Behind Cloudflare;

89.21.64.132,

Hydra Communications Ltd (Switzerland)

exch.pw Registrar: NETIM

Registered: 12 July 2022

149.202.88.23, Ovh Sas (France)
exch.bz Registrar: Namecheap

Registered: 22 July 2022

149.202.88.23, Ovh Sas (France)
exch.net Registrar: Eranet International Limited

Registered: 18 September 1998

Registrant Location: Roches, Switzerland

Historic Registrant: Ryan Gibbs

Historic Registrant Organisation: Shear Water Electronics

Historic Registrant Email: hostmaster@exch.net

Country: United States

89.21.64.132,

Hydra Communications Ltd (Switzerland)

Our research uncovered that Vincent Ritter is the registrant of an additional domain, paisibledog.com, which was registered through Wix.com Ltd on 13 August 2023. This domain is linked to the Peaceful Dog Association (Siret: 92393841900010), a registered entity in France. On paisibledog.com, Vincent appears as a canine behaviourist educator.

Exch[.]net was previously registered by Ryan Gibbs, who was based in Sheboygan, Wisconsin. Based on information from his Facebook account, it appears that Ryan has passed away.

We also investigated unofficial domains and their associated infrastructure providers, summarized in the table below.

Unofficial Domains

Domain Notes IP address / ISP
exch.cc No longer associated with eXch

Historic registrant country: Russian Federation (23 July 2017)

Registrar: Domain Bazaar LLC

Registered: 30 December 2024

185.196.11.206,

Global-Data System IT Corporation, Switzerland

exch.cy Not associated with eXch 185.196.11.206,

Global-Data System IT Corporation, Switzerland

exch.cd Not associated with eXch

Registrar: SCPT

Registered: 30 December 2024

Registrant Country: Germany

185.196.11.206,

Global-Data System IT Corporation, Switzerland

 Further Internet-of-Things (IoT) investigations into the domains exch.cx and exch.pw have identified the following IP servers.

IP server ISP / IP Geolocation Details
178.196.156.76 Bluewin, Switzerland 178.196.156.76:3389

Banner:

Remote Desktop Protocol

Flag: PROTOCOL_HYBRID_EX

Target_Name: EXCH

Product_Version: 10.0.20348

Ntlm 15 OS: Windows Server 2022 NetBIOS_Domain_Name: EXCH NetBIOS_Computer_Name: WINSERVER DNS_Domain_Name: exch.ch DNS_Computer_Name: winserver.exch.ch MsvAvDnsTreeName: exch.ch

System_Time: 2025-03-03 05:33:52 +0000 UTC

Certificate Common Name:

winserver.exch.ch

178.196.156.76 Bluewin, Switzerland home.exchange.ch:3389

Domain: exchange.ch

83.219.124.187 Quickline AG, Switzerland 83.219.124.187:3389

Banner:

Remote Desktop Protocol

Flag: PROTOCOL_HYBRID_EX

Target_Name: EXCH

Product_Version: 10.0.20348 Ntlm 15

OS: Windows Server 2022

NetBIOS_Domain_Name: EXCH

NetBIOS_Computer_Name: WINSERVER

DNS_Domain_Name: exch.ch

DNS_Computer_Name: winserver.exch.ch

MsvAvDnsTreeName: exch.ch

System_Time: 2024-10-10 16:48:53 +0000 UTC

62.204.103.42 Quickline AG, Switzerland Banner:

Remote Desktop Protocol

Flag: PROTOCOL_HYBRID_EX

Target_Name: EXCH

Product_Version: 10.0.20348 Ntlm 15

OS: Windows Server 2022

NetBIOS_Domain_Name: EXCH

NetBIOS_Computer_Name: WINSERVER

DNS_Domain_Name: exch.ch

DNS_Computer_Name: winserver.exch.ch

MsvAvDnsTreeName: exch.ch

System_Time: 2024-09-24 11:04:29 +0000 UTC

89.21.64.132 Hydra Communications Ltd, Switzerland Certificate Common Name: exch.pw

DNS Names: exch.bz, exch.cx, exch.pw

 

185.196.11.206 Global-Data System IT Corporation, Switzerland Certificate Common Name: exch.cc

DNS Names: exch.cc, exch.cd, exch.cy, www.exch.cc, www.exch.cd, www.exch.cy

192.248.188.186 Vultr Holdings, LLC, Germany

 

Certificate Common Name: exch.pw

DNS Names: exch.bz, exch.cx, exch.pw

 

Further investigations using Shodan with the query ssl.cert.subject.cn:exch.cx have uncovered an additional IP server located in Sweden.

IP Server / IP Geolocation Details
65.20.113.121, Stockholm, Sweden ISP: Vultr Holdings, LLC

SSL Certificate Subject: CN=mailserver.exch.cx

DNS:autoconfig.exch.cx, DNS:autodiscover.exch.cx, DNS:mailserver.exch.cx

Offshore Investigations – Private Project Facilitators LTD, Belize

Investigations in Belize have uncovered the company Private Project Facilitators LTD (Registration Number: 176168; Registration Date: 2014; Registration Status: Not re-registered). This entity was registered as an International Business Company (IBC) but has not completed re-registration with the Companies Registry. As a result, under the Belize Companies Act 2022, the company is considered non-compliant, and no corporate information is available. The company was managed by foreign shareholders, and its banking operations in Belize were handled by Scotiabank.

eXch Android APK

An Android APK named “eXch” was discovered on the official eXch websites. The application was developed by the GitHub user “pitonite” and is available for download on F-droid.org.

The developer, “pitonite”, registered a GitHub account using the email address pitonite@proton.me.

Exploring Historical Breach Data

Investigations into historic breach datasets have revealed the following information, as displayed in the table below.

Database Notes
Bitcointalk.org Registered email: admin@exch.cc

Registered IP: 176.199.169.9 (geolocation: Wuppertal, North Rhine-Westphalia, Germany, ISP: Vodafone West GmbH)

Bitcointalk.org Registered email: support@exch.cc

Registered IP: 178.200.210.174 (Dillenburg, Hesse, Germany, ISP: Vodafone West GmbH)

Mmgp.ru Registered email: admin@exch.cc

Registered IP: 178.203.196.55 (geolocation: Werl, North Rhine-Westphalia, Germany, ISP: Vodafone West GmbH)

Open-source intelligence investigations have linked the below Bitcoin address to eXch.cx:

  • bc1qu2dq8w8lv8v3l7lr2c5tvx3yltv22r3nhkx7w0

Blockchain Analysis

Using AMLBot, a blockchain analysis tool, investigators examined this Bitcoin address, which has been flagged as an Illegal Service.

Below is a chart by relevant identified categories, incorporating the total amounts in BTC for the incoming transactions to the BTC address associated with eXch.cx.

Below is a breakdown by category, incorporating the total amounts in both BTC and USD (using the exchange rate of $81,355 per BTC) for the incoming transactions to the BTC address associated with eXch.cx.

INCOME CATEGORY AMOUNT (BTC) AMOUNT USD INCOME %
STOLEN COINS 139.8108946 $11,374,492.88 1.93%
MIXERS 682.5222296 $55,511,029.86 9.41%
SCAMS 15.62783278 $1,270,835.62 0.22%
SANCTIONS / SANCTIONED ENTITIES 3.71062463 $301,787.62 0.05%
DARK MARKETS 0.2082558 $16,939.92 0.00%
ILLEGAL SERVICES 567.0290591 $46,158,355.83 7.82%
UNLICENSED EXCHANGES & P2P 629.9296306 $51,229,372.24 8.70%
LICENSED EXCHANGES 233.0659055 $18,956,998.82 3.21%
MINERS 8.03458761 $653,546.19 0.11%
GAMBLING 8.07953746 $657,191.43 0.11%
PAYMENTS 8.74783249 $711,501.10 0.12%
WALLETS 4.96584614 $403,941.72 0.07%
UNKNOWN CLUSTERS 30.68984771 $2,496,862.42 0.42%
UNNAMED ENTITIES 6,981.18 $568,036,359.35 96.84%

Below is a summary table of some of the incoming high-risk transactions associated with this address.

INCOME CATEGORY AMOUNT (BTC) AMOUNT (USD) INCOME %
THORCHAIN Mixer 539.8535691 $44,911,173.12 66.68%
TRADEOGRE Exchange Unlicensed 109.9772013 $9,148,268.13 13.60%
VICTIM REPORT Stolen Coins 85.95247634 $7,153,568.93 10.62%
CHIPMIXER.COM Enforcement Action 80.64805531 $6,713,879.26 9.96%
FRAUD REPORTED Scam 11.99992832 $998,542.56 1.48%
VICTIM REPORT Stolen Coins 19.11194504 $1,590,732.59 2.36%
BYBIT THIEF 2025 Stolen Coins 7.08835193 $590,048.84 0.88%
BLENDER.IO Sanctions 3.64363875 $303,304.69 0.45%
FRAUD REPORTED Scam 3.62790446 $301,991.33 0.45%
WAZIRX THIEF 2024 Stolen Coins 1.999986 $166,423.20 0.25%
POTENTIAL BTCTURK THIEF 2024 Stolen Coins 0.73545457 $61,203.31 0.09%
ASAP MARKET Dark Market 0.03678158 $3,060.28 0.01%
POTLUCK DARKMARKET Dark Market 0.01506651 $1,253.92 0.00%
INCOGNITO MARKET Dark Market 0.00852141 $709.58 0.00%
BITZLATO (PREV. BTC BANKER) Enforcement Action 0.00192332 $160.07 0.00%

 Note: The USD amounts are calculated using the current Bitcoin price of $83,211.87 USD per BTC as of 17 March 2025.

Below is a chart by relevant identified categories, incorporating the total amounts in BTC for the outgoing transactions from the BTC address linked to eXch.cx.

Below is a breakdown by category, incorporating the total amounts in both BTC and USD (using the exchange rate of $81,355 per BTC) for the outgoing transactions from the BTC address linked to eXch.cx.

OUTCOME CATEGORY AMOUNT IN BTC AMOUNT IN USD OUTCOME %
STOLEN COINS 542.707371 $44,137,154.77 41.33%
DARK MARKETS 129.3464858 $10,536,242.93 9.85%
SCAMS 88.65778454 $7,208,076.62 6.76%
GAMBLING 84.88965817 $6,899,188.72 6.47%
MIXERS 62.31477927 $5,070,847.96 4.75%
EXCHANGE LICENSED 69.41107061 $5,642,827.18 5.29%
EXCHANGE UNLICENSED 59.01517058 $4,804,280.44 4.49%
PAYMENTS 45.22875994 $3,678,484.34 3.44%
TRANSPARENT 41.68 $3,384,178.00 3.18%
OTHER 41.82307835 $3,397,436.63 3.19%
WALLETS 35.68931531 $2,899,768.58 2.72%
UNKNOWN CLUSTERS 13.18124642 $1,071,431.33 1.00%
MINERS 11.87088396 $965,363.61 0.90%
SANCTIONS 4.76258788 $387,228.61 0.36%
TERRORISM FINANCING 3.21634592 $261,604.89 0.24%
UNNAMED ENTITIES 1.34901001 $109,114.22 0.10%
SETTLED 0.37961285 $30,845.51 0.03%

The table below relates to outgoing transactions associated with illicit entities. These transactions involve stolen coins, dark markets, mixers, sanctions, and other illicit activities.

OUTCOME CATEGORY AMOUNT (BTC) AMOUNT (USD) OUTCOME %
THORCHAIN Mixer 2,450.12 $203,882,370.15 76.49%
BYBIT THIEF 2025 Stolen Coins 496.6338335 $41,332,728.15 15.50%
WASABI WALLET Mixer 102.5220427 $8,531,032.12 3.20%
VICTIM REPORT Stolen Coins 69.47553264 $5,781,241.37 2.17%
VICTIM REPORT Stolen Coins 29.28541304 $2,437,815.25 0.91%
INFINITY EXCHANGER Dark Market 18.90449144 $1,573,597.58 0.59%
VICTIM REPORT Stolen Coins 6.26747095 $521,663.23 0.20%
DPRK RELATED Stolen Coins 5.05838671 $421,043.58 0.16%
WAZIRX THIEF 2024 Stolen Coins 4.16855162 $346,957.34 0.13%
DPRK RELATED Stolen Coins 2.32374111 $193,410.26 0.08%
DPRK RELATED Stolen Coins 1.58324806 $131,786.97 0.06%
DPRK RELATED Stolen Coins 1.05290093 $87,601.25 0.04%
KRAKEN DARKNET Dark Market 0.4955226 $41,259.47 0.02%
BITPAPA Sanctions 0.17786449 $14,798.93 0.006%
BLACK SPRUT Dark Market 0.09387868 $7,812.30 0.003%
OFAC: ZSERVERS Sanctions 0.05045284 $4,198.02 0.002%
OURPRIVATESHOP Dark Market 0.01089838 $906.69 0.0004%
MEGA DARKNET MARKET Dark Market 0.00979347 $814.88 0.0003%
OMG!OMG! Dark Market 0.00145286 $120.85 0.00005%
REPORTED ENTITY Terrorism Financing 0.00038052 $31.68 0.00001%

Notably, eXch.cx relies on Thorchain for liquidity provision, especially for significant BTC-to-ETH swaps.

Open-source intelligence investigations have linked the below Ethereum address to eXch.cx:

  • 0xf1da173228fcf015f43f3ea15abbb51f0d8f1123

The ETH address linked to exch[.]cx has received a significant volume of funds from various sources, including stolen funds, scams, illicit exchanges, mixers, and gambling platforms. The majority of transactions indicate high-risk activity, particularly linked to theft and fraud.

Below is a chart by relevant identified categories, incorporating the total amounts in ETH for the incoming transactions to the ETH address linked to eXch.cx.

Below is a breakdown of incoming transactions by category for the ETH address of exch.cx. The table includes the amount in ETH and the corresponding amount in USD, using an exchange rate of $1,800 per ETH.

INCOME CATEGORY AMOUNT IN ETH AMOUNT IN USD INCOME %
UNNAMED ENTITIES 189,134.26 $340,413,678.19 71.51%
ILLEGAL SERVICES 17,089.51 $30,760,114.12 6.46%
STOLEN COINS 10,514.05 $18,923,286.56 3.97%
UNKNOWN CLUSTERS 8,892.35 $16,021,228.27 3.36%
OTHER 7,761.87 $13,978,774.90 2.94%
P2P EXCHANGE UNLICENSED 4,716.33 $8,491,739.04 1.78%
EXCHANGE LICENSED 2,407.52 $4,334,548.66 0.91%
MIXERS 753.7938186 $1,355,826.87 0.29%
WALLETS 467.7999635 $841,019.94 0.18%
SCAMS 306.7109819 $552,078.77 0.12%
SANCTIONS 146.2166856 $263,206.03 0.06%
MARKETPLACE (E.G., OPENSEA.IO) 66.76108494 $120,153.95 0.03%
LIQUIDITY POOLS 5.04047344 $9,072.85 0.002%
ATM 0.10421111 $187.57 0.00004%

Below is a summary table of some incoming illicit transactions associated with this ETH address.

INCOME CATEGORY AMOUNT (ETH) AMOUNT (USD) INCOME %
THORCHAIN Mixer 64,010.18 $115,218,326.73 84.08%
BYBIT THIEF 2025 Stolen Coins 4,816.63 $8,654,971.90 6.33%
WAZIRX THIEF 2024 Stolen Coins 3,630.37 $6,534,657.01 4.77%
POTENTIAL PHEMEX THIEF 2025 Stolen Coins 1,348.30 $2,426,927.02 1.77%
TORNADO CASH Sanctions 146.2166856 $263,211.01 0.19%
ASTROPORT THIEF Stolen Coins 89.99956773 $161,999.21 0.12%
UNILEND FINANCE THIEF 2025 Stolen Coins 29.99995536 $53,999.91 0.04%
INDODAX THIEF 2024 Stolen Coins 23.10401651 $41,593.23 0.03%

The chart below presents the total amounts in ETH for outgoing transactions from the ETH address associated with eXch.cx, categorized by relevant identified groups.

Below is a breakdown of outgoing transactions by category for the ETH address of exch.cx. The table includes the amount in ETH and the corresponding amount in USD, using an exchange rate of $1,800 per ETH.

OUTCOME CATEGORY TOTAL AMOUNT (ETH) TOTAL AMOUNT (USD) OUTCOME %
UNCATEGORIZED/UNNAMED 271,356.65 $488,442,009.95 86.56%
OTHER 17,141.34 $30,864,406.23 5.47%
STOLEN COINS 10,257.62 $18,464,732.81 3.27%
P2P EXCHANGE UNLICENSED 9,288.40 $16,734,123.47 2.96%
EXCHANGE LICENSED 4,102.51 $7,385,512.09 1.31%
ILLEGAL SERVICES 3,740.03 $6,732,058.73 1.19%
SETTLED 3,186.77 $5,726,150.42 1.02%
UNKNOWN CLUSTERS 2,833.00 $5,099,400.59 0.90%
SANCTIONS 2,440.70 $4,393,263.61 0.78%
UNLICENSED EXCHANGE 2,353.07 $4,234,537.82 0.75%
WALLETS 1,728.84 $3,113,962.41 0.55%
SCAMS 1,234.81 $2,223,670.43 0.39%
MIXERS 1,062.88 $1,912,862.55 0.34%
GAMBLING 417.67 $752,832.67 0.13%
MARKETPLACES 417.22 $751,760.83 0.13%
TERRORISM FINANCING 0.0013 $2.29 0.000004%

Below is a summary table of some outgoing illicit transactions associated with this ETH address.

OUTCOME CATEGORY AMOUNT (ETH) AMOUNT (USD) OUTCOME %
THORCHAIN Mixer 17,235.12 $31,023,222.60 86.31%
TORNADO CASH Sanctions 2,440.70 $4,393,263.71 12.23%
BYBIT THIEF 2025 Stolen Coins 264.27 $475,692.20 1.32%
PINK THIEF 2024 Stolen Coins 108.95 $196,101.56 0.55%
GARANTEX Sanctions 20.16 $36,295.59 0.10%
UNILEND FINANCE THIEF 2025 Stolen Coins 0.28 $496.51 0.0014%
ATOMIC WALLET ALL THIEF 2023 Stolen Coins 0.16 $281.59 0.0008%
WHALE HUNTER’S PAYDAY THIEF Stolen Coins 0.03 $52.88 0.0002%
ORDIZK THIEF Stolen Coins 0.01 $23.29 0.00005%
RHO MARKET THIEF 2024 Stolen Coins 0.01 $10.20 0.00005%

Conclusions

The investigation into eXch.cx reveals its involvement in high-risk financial activities, such as money laundering, supporting cybercriminals, and facilitating illegal transactions. The platform handles large sums linked to hacking groups and darknet markets, all while refusing to cooperate with law enforcement or other crypto exchanges.

This case emphasizes the urgent need for increased regulations and law enforcement actions in the cryptocurrency space. Platforms like eXch.cx operate with little oversight, allowing criminal activities to thrive. Tightening regulations and increasing collaboration between the private sector, blockchain investigators, and law enforcement can help combat illicit activities and reduce risks associated with these unregulated entities.

A more robust regulatory framework and targeted investigations are needed to mitigate risks posed by entities like eXch.cx and to ensure that cryptocurrency platforms adhere to anti-money laundering and counter-terrorism financing standards.

 

administrator

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Seraphinite AcceleratorOptimized by Seraphinite Accelerator
Turns on site high speed to be attractive for people and search engines.