At Caudena, our blockchain intelligence team has been hard at work understanding the patterns of cryptocurrency mixing service “eXch” (exch.cx), including its connections to the Thorchain ecosystem. While eXch would perhaps dispute using the terminology ‘mixer’ to describe their cross-chain swap service, Caudena’s on-chain analysis shows that a significant percentage of users are using it solely for obfuscation purposes – by swapping funds to another chain and immediately swapping back to the originating chain.
This analysis comes in light of eXch’s recent confrontational stance, as they defend their active facilitation of laundering proceeds from the recent $1.5 billion ByBit hack.
Refusal to Cooperate
eXch has publicly refused to cooperate with ByBit following the $1.5 billion hack conducted by North Korea’s Lazarus Group despite evidence showing that a portion of these stolen funds are actively being laundered through eXch’s service. Rather than assist in recovery efforts, eXch posted screenshots on Bitcointalk revealing their refusal to cooperate, citing “reputation harm” from ByBit due to their addresses being labeled as “high risk”.
While they claim that “the insignificant portion of funds from the ByBit hack” that entered their service was “an isolated case,” our analysis indicates ongoing laundering activity. Their claim that they are “NOT laundering money for Lazarus/DPRK” is contradicted by conclusive blockchain evidence showing their continued processing of funds related to the hack.
Regulatory Defiance and Antagonism
Last month, eXch had published an adversarial “demand letter” on Bitcointalk, directly challenging major regulatory bodies including the IRS, DOJ, SEC, and OFAC. The service explicitly threatened to implement additional obfuscation measures if their demands weren’t met, demonstrating a clear intent to evade regulatory oversight.
The “Demand Letter”
The letter asks public agencies and private companies to “stop discrimination and abuse” towards eXch, claiming that analytics tools are targeting them by labelling them as high risk.
They have pr
