Crypto exchange eXch accused of secretly operating after claiming to shut down

Blockchain forensics firm TRM Labs has claimed that crypto exchange eXch is still operating despite announcing its shutdown. Analysts at the firm disclosed this in a new report, pointing to on-chain activity.

eXch announced it would shut down on May 1 due to allegations that it helped hackers in laundering part of $1.4 billion stolen from Bybit in February. Although the exchange denied the allegations, it still said it would shut down in an April 17 statement.

In line with the planned shutdown, eXch has been closing some of its infrastructure throughout April. This included removing four dark web and clearnet domains on April 30 and ending support for its browser interface on April 27.

Despite all these changes, TRM Labs analysts reported on-chain activity that suggests that some of eXch’s infrastructure is still interacting with funds linked to child sexual abuse material (CSAM) threat actors.

It said:

“TRM observed on-chain activity on April 30, 2025 similar to what we previously identified as eXch mixed-pool operations that are exposed to CSAM. This infrastructure remained active and interacted with newly withdrawn funds linked to CSAM over several days.”

The firm noted that this on-chain activity suggests that the platform might still be active even if it is now operating in secrecy. It added that eXch itself had said it would still offer an application programming interface (API) to partners, and bad actors might still be using this infrastructure.

Mixed pools are central to eXch’s functionality

Meanwhile, TRM Labs attributed eXch’s performance to its mixed-pool structure. This allows the exchange to hide the source and destination of assets, making it more difficult to trace funds moved through the exchange.

Mixed pools are like swap services where users can deposit one coin and swap for another. Since all deposits of the same coin are pooled together and used as liquidity for withdrawals, it is possible for legitimate and illicit funds to mix, and for anyone to withdraw.

The firm added that there is no sign that eXch assesses the origin of incoming funds, and its infrastructure system is unclear, making it easy for bad actors to rely on it for moving funds.

However, eXch claimed its goal is to support privacy and not to serve criminals and condone illicit activities. Despite this, TRM Labs noted that the exchange refused to help freeze Bybit funds, which is likely connected to the $1.4 billion hack, a decision that put it in the spotlight.

Blockchain forensic analysts believe that the exchange has been facilitating illicit transactions long before the Bybit incident. According to TRM analysts, eXch is the leading exchange for moving CSAM-related funds, with over $300,000 in those funds having been deposited to the exchange.

It added that CSAM funds were even instrumental in providing liquidity for the Bybit hackers to swap assets when they were using the exchange to launder the stolen funds.

What is next for eXch?

It is unclear what the exchange plans to do next. Although it has announced a shutdown, on-chain activity shows it is still operating, raising doubts about the platform’s intention.

According to TRM Labs, the exchange had already removed all communications about its shutdown a few hours after posting it on April 27 and was already operating again by April 28. The firm believes these mixed communications might be due to internal disagreements between the platform’s stakeholders or just a plan to get the public off its back.

Interestingly, the exchange also said it would transfer management of its infrastructure to another team by May 1, while the original team would remain in a consultant capacity and provide recommendations.

This move hints at a possible rebrand by the exchange, particularly as part of the recommendation is for eXch to create dedicated liquidity pools. TRM analysts believe this is a plan to hide the on-chain connections to previous activity.

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot