eXch Denies Helping Hackers Move Bybit’s Stolen Assets

Key Takeaways:

• eXch exchange denies accusations of laundering funds from the Bybit hack for North Korea’s Lazarus Group.
• Exchange admits processing a small portion of stolen funds but insists it was an isolated event.
• Investigators claim eXch processed up to $35 million in stolen funds.

eXch, a non-KYC cryptocurrency exchange, has refuted claims that it facilitated money laundering for the Lazarus Group, the North Korean hacking syndicate linked to the recent $1.4 billion Bybit hack.

eXch Exchange Dismisses Money Laundering Allegations

In a February 23 discussion on the Bitcointalk forum, eXch categorically denied any involvement, stating, “We are not laundering money for Lazarus/DPRK.”

eXch denies involvement in the $1.4 billion Bybit hack/ Source: Bitcointalk forum

While maintaining its innocence, the non-KYC exchange conceded to inadvertently processing some of the stolen assets, promising to donate related transaction fees to public causes.

Despite eXch’s denial, several blockchain security firms and investigators claim otherwise. 

Independent blockchain analyst ZachXBT alleged that eXch processed approximately $35 million in stolen funds and mistakenly transferred 34 Ether to another exchange’s hot wallet.

ZachXBT claims that eXch processed stolen funds/ Source: Zach Investigation channel

Security firm SlowMist also reported that a “significant amount of ETH” had been converted into other cryptocurrencies through eXch.

Nick Bax, a white hat hacker with the Security Alliance, estimated that eXch facilitated roughly $30 million worth of transactions for Lazarus Group on February 23.

These findings further fueled concerns that eXch played a key role in laundering the stolen assets.

Bybit Faces Resistance from eXch on Asset Recovery

Following the February 21 attack on Bybit's Ether multi-signature cold wallet—now recorded as crypto's largest theft—the exchange moved swiftly to contain the damage.

Through swift coordination with industry partners, Bybit managed to freeze $42 million of the stolen funds. However, their recovery efforts hit a roadblock when seeking cooperation from the eXch exchange.

A coordinated effort led to the freezing of $42.89M in just one day. Thanks to the following teams for their swift action: @Tether_to: Flagged address and froze 181K USDT @THORChain: Blocked the blacklist @ChangeNOW_io: Froze 34 ETH @FixedFloat: Froze 120K USDC + USDT…

— Bybit (@Bybit_Official) February 23, 2025

When Bybit's risk team reached out to eXch for help freezing additional stolen assets, they encountered fierce pushback. 

In a pointed Bitcointalk forum response, eXch refused to cooperate and brought up past grievances. 

The exchange claimed Bybit had previously frozen their users' deposits without cause and systematically ignored support tickets—a history of friction that now threatened to derail crucial asset recovery efforts.

eXch accused Bybit of direct attacks on its reputation/ Source: Bitcointalk forum

Bybit CEO Ben Zhou responded to eXch’s stance, urging them to reconsider and prevent the illicit outflow of funds. He emphasized that the broader crypto industry must collectively combat hackers rather than prioritize individual interests.

ByBit's Path to Recovery

In response to the crisis, Bybit launched a recovery initiative, offering a 10% bounty to security researchers and organizations that assist in reclaiming lost assets. 

The exchange then moved decisively to stabilize its operations, securing approximately 446,870 ETH, worth $1.24 billion, through a strategic combination of loans, whale deposits, and Ethereum purchases.

Since being hacked, #Bybit has received ~446,870 $ETH($1.23B) through loans, whale deposits, and ETH purchases.#Bybit has nearly closed the gap. pic.twitter.com/0oz3ytLi4X

— Lookonchain (@lookonchain) February 24, 2025

In a February 24 post on X, Zhou confirmed that the exchange has now fully replaced the stolen assets. 

He also announced that Bybit will soon publish an audited proof-of-reserve report using a Merkle tree to verify that client assets remain at a 1:1 ratio.