Key Takeaways
- Xchange.cash, Baksman.com, and Prostocash.com were taken down
- The platforms were shut down for bypassing “Know Your Customer” (KYC) regulations
German authorities have dismantled 47 cryptocurrency exchanges allegedly involved in facilitating money laundering for cybercriminals. The platforms, which operated without adhering to anti-money laundering (AML) protocols, allowed users to conduct anonymous transactions, making them attractive to those engaging in illegal activities such as ransomware and darknet trading.
The Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor’s Office announced the operation on September 19, stating that the platforms were shut down for bypassing “Know Your Customer” (KYC) regulations. This loophole enabled users to trade digital currencies without any identity verification, effectively creating a space for criminals to launder their illicit gains.
“Exchange services that allow such anonymous transactions are crucial in the criminal value chain of cybercrime,” the BKA said in a statement. The report added that the services were used by a range of cybercriminals, including ransomware operators and dark web traders, to funnel their illegally acquired wealth into the mainstream economy.
Some of the most prominent platforms seized in this operation include Xchange.cash, a service that had been operational since 2012, reportedly handling over 1.3 million transactions for more than 400,000 users. Other significant exchanges like 60cek.org, Baksman.com, and Prostocash.com were also taken offline.
Visitors to these platforms are now redirected to a government warning page under the banner of “Operation Final Exchange.” The message states that their personal information, transaction histories, and IP addresses have been seized and are now in the hands of the authorities. “We have your data—transactions, registration data, IP addresses. Our search for traces begins.”
While this operation represents a substantial win for German law enforcement, the authorities acknowledged the difficulty in prosecuting all involved, as many of the platform users and operators are based in other countries. “Cybercriminals often reside abroad and are either tolerated or protected by some countries, which makes them difficult for German authorities to apprehend,” the BKA noted.
The takedown is part of a broader strategy by Germany to dismantle the financial frameworks that support cybercrime. Earlier efforts included the 2023 seizure of Chipmixer, a darknet service used to launder funds, which led to the recovery of €90 million. The country has also been active in targeting malware networks, contributing to the takedown of Kingdom Market and disrupting major malware operations like Qakbot and Emotet.
