German Authorities Shut Down 47 Crypto Exchanges Used by Cybercriminals

German law enforcement agencies, including the Federal Criminal Police Office (BKA) and the Central Office for Combating Cybercrime (ZIT), dismantled 47 cryptocurrency exchange platforms operating in Germany. These platforms, which facilitated anonymous currency transactions without proper Know-Your-Customer (KYC) checks, were widely used for laundering money earned through cybercrime.

The investigation targeted platforms hosting both fiat and cryptocurrency exchanges. These services enabled users to convert digital assets with complete anonymity, bypassing essential legal safeguards designed to prevent financial crimes. The operators of these exchanges are now facing charges of money laundering and operating illegal trading platforms under German law (sections 127 and 261 of the German Criminal Code).

Exchanges facilitating cybercrime

The exchanges in question offered services that allowed users to convert cryptocurrencies quickly and anonymously. By neglecting KYC regulations, they became instrumental in concealing the origins of criminal funds. Ransomware groups, darknet traders, and botnet operators were among the key clientele of these platforms, using them to launder ransom payments and other illicit gains into mainstream financial systems.

A few notable busts in terms of their size are:

• Xchange.cash: Operational since 2012, it had over 410,000 users and processed more than 1.2 million transactions.
• 60cek.org: Launched in 2016, it handled nearly 900,000 transactions from over 300,000 users.
• Baksman.com: Another major player, active since 2016 and recorded more than 750,000 transactions.
• Prostocash.com: Started in 2017, facilitated over 470,000 transactions from nearly 267,000 users.

These platforms attracted cybercriminals by offering no-registration-required services, which made it easier to convert ransomware payments or stolen cryptocurrency into legal tender without scrutiny. The BKA emphasized that this infrastructure was a key element in the “criminal value chain” of cybercrime.

Data seizure and future investigations

As part of the operation, BKA and ZIT seized vast amounts of data from the confiscated servers, including user information, transaction histories, and IP addresses. The data will serve as a critical foundation for future investigations, providing leads to track down both operators and users of these illegal services. Authorities revealed that these seized details will significantly enhance their efforts to combat cybercrime by identifying the individuals behind these activities.

In addition to this latest move, German authorities have been pursuing similar operations. In 2023, they successfully took down ChipMixer, a crypto-mixing service that helped criminals anonymize transactions, seizing assets worth approximately 90 million euros. Other high-profile takedowns included the shutdown of Kingdom Market, a darknet marketplace, and the disabling of the notorious Qakbot and Emotet malware networks, which had caused global damages in the hundreds of millions of euros.

Given that cybercriminals often operate from foreign jurisdictions where they enjoy a level of protection or impunity, German authorities have focused on dismantling the infrastructure that supports their operations. By targeting these anonymous exchange services, they have disrupted a key mechanism through which cybercriminals convert illicit earnings into usable assets.

The seized platforms are now displayed on the “Final Exchange” website, which carries a stern message aimed at criminals, warning them that law enforcement has all their data and will soon initiate further investigations.