Exch：拒绝与Bybit合作以恢复被盗资金的硬币混音器

2月21日晚上，交易所交易所遭受了历史上最大的盗窃。许多机构和个人借助一只手来帮助束缚这场危机。尽管危机已经暂时控制，但下一个关键任务是尝试跟踪和拦截黑客资金并恢复被盗资产。

On the evening of February 21, cryptocurrency exchange Bybit suffered the largest theft in history. Many institutions and individuals lent a hand to help Bybit through this crisis. Although the crisis has been temporarily controlled, the next key task is to try to track and intercept the hacker funds and recover the stolen assets.

2月21日晚上，加密货币交易所Bybit遭受了历史上最大的盗窃。许多机构和个人借助一只手来帮助束缚这场危机。尽管危机已经暂时控制，但下一个关键任务是尝试跟踪和拦截黑客资金并恢复被盗资产。

However, in the past two days, the eXch platform has laundered more than 29,000 ETH stolen from Bybit by Lazarus hackers. The platform immediately attracted widespread attention in the crypto community, and many users said that despite their many years in the industry, they had never heard of the eXch project before.

但是，在过去的两天中，Lazarus Hackers从Bybit偷了29,000多名ETH。该平台立即在加密社区引起了广泛的关注，许多用户表示，尽管他们从事该行业多年，但他们以前从未听说过Exch项目。

So, what kind of platform is eXch? What role did it play in this incident?

那么，交流是什么样的平台？它在此事件中扮演着什么角色？

What is eXch?

什么是口气？

eXch is a centralized coin mixer that does not require KYC. The basic function of a coin mixer is to mix funds from different users, thereby disrupting the source and destination of transactions, making it difficult for external observers to track the transaction path.

Exch是一种集中式硬币混合器，不需要KYC。硬币混合器的基本功能是混合来自不同用户的资金，从而破坏交易的来源和目的地，使外部观察者很难跟踪交易路径。

Users can freely exchange BTC, LTC, ETH, XMR and other tokens on eXch. After selecting the type and quantity of the token to be traded, and setting the receiving address and refund address, the platform will complete the transaction at the Bisq price (based on the median value of market transaction data). The exchange claims that its liquidity is not provided by a third party, but is stored on its own nodes.

用户可以在Exch上自由交换BTC，LTC，ETH，XMR和其他令牌。在选择要交易的令牌的类型和数量并设置接收地址和退款地址之后，该平台将以BISQ价格完成交易（基于市场交易数据的中位数）。交易所声称其流动性不是由第三方提供的，而是以其自身的节点存储。

Although it seems very convenient, users who have actually used eXch said that the actual experience is very bad, the handling fees and spreads are very high, and when liquidity is exhausted, they need to wait for staff to manually send tokens, and sometimes they are sent to the wrong address. Some community members even said that under the premise of such high handling fees and slippage (nearly 10%), only money laundering teams will use this platform.

尽管看起来非常方便，但实际使用过口气的用户说，实际经验非常糟糕，处理费和差价很高，当流动性耗尽时，他们需要等待员工手动发送令牌，有时他们有时他们被发送到错误的地址。一些社区成员甚至说，在如此高的处理费和打滑的前提下（近10％），只有洗钱团队才能使用此平台。

There is currently no information about the eXch team on the Internet. There is only an X account named @exchcx that is certified as its representative, but the account has not been updated for more than a year.

目前没有关于Internet上的交易所的信息。只有一个名为@Exchcx的X帐户被认证为其代表，但该帐户在一年多以上尚未更新。

eXch refuses to cooperate with Bybit to recover stolen funds

Exch拒绝与Bybit合作以收回被盗的资金

After the incident, Bybit CEO began to seek support from all walks of life, hoping to jointly intercept the stolen funds.

事件发生后，Bybit首席执行官开始寻求各行各业的支持，希望共同拦截被盗的资金。

On February 22, on-chain detectives discovered that the 5,000 stolen ETH were laundered through eXch and converted to Bitcoin through Chainflip. In response to this discovery, Bybit asked eXch to block the funds and track their movements. However, eXch made the request public and refused to cooperate. In its reply to Bybit, eXch mentioned that since its users had been banned by Bybit, they would not provide any help.

2月22日，链侦探发现，5,000名被盗的ETH通过交流洗钱，并通过Chainflip转换为比特币。为了响应这一发现，拜比特要求交易所阻止资金并跟踪他们的动作。但是，交易所公开请求并拒绝合作。在对Bybit的答复中，Exch提到，由于其用户已被Bybit禁止，因此他们不会提供任何帮助。

In this regard, there are two different voices in the community:

在这方面，社区中有两种不同的声音：

On February 23, eXch released a statement on bitcointalk, saying that it "will not launder money for Lazarus/DPRK" and that the funds from the previous attack on Bybit will be donated to various open source projects. They emphasized that this move is to protect the concept of decentralization (not your keys, not your money.) and pointed out that Trorchain has processed more black money than them.

2月23日，Exch在BitCointalk上发表了一份声明，称“不会为Lazarus/Dprk洗钱”，并且先前对Bybit攻击的资金将捐赠给各种开源项目。他们强调，此举是为了保护权力下放的概念（不是您的钥匙，而不是您的钱。），并指出Trorchain处理的黑钱比他们更多。

In response, many community members began to criticize eXch. Crypto KOL @tayvano_ joked about eXch's behavior of dragging down Thorchain, saying "because every time liquidity is exhausted, eXch will rely on Thorchain." Some users even suggested that all VASPs should directly blacklist eXch, believing that their practice is money laundering.

作为回应，许多社区成员开始批评交流。 Crypto Kol @Tayvano_开玩笑说Exch的行为拖到Thorchain的行为，说：“因为每次流动性耗尽时，Exch都会依靠Thorchain。”一些用户甚至建议所有VASP都应该直接进行黑名单交流，认为他们的实践是洗钱。

And eXch’s response seems to always be the same slogan: maintaining the ideal of decentralization.

埃夫的反应似乎总是相同的口号：保持权力下放的理想。

Is it necessary for a coin mixer to exist?

硬币混合器是否有必要存在？

But this is not the first time hackers have used eXch to launder coins.

但这并不是黑客第一次使用交易所洗钱硬币。

In December 2024, in a theft reported by ZachXBT, the stolen funds eventually flowed to eXch for laundering, converted into LTC and put into the market. At that time, the stolen assets were worth 6.5 million US dollars.

2024年12月，在Zachxbt报道的一次盗窃案中，被盗的资金最终流向了洗钱，转变为LTC并投入市场。当时，被盗的资产价值650万美元。

In September 2024, economic data aggregator Truflation suffered a hacker attack, losing about $5 million, and funds were stolen from the treasury multi-signature and personal wallets. A month later, the Truflation attacker exchanged 1.37 million DAI for 500 ETH and transferred it to eXch.

2024年9月，经济数据聚合器的陷阱遭受了黑客袭击，损失了约500万美元，资金从财政部的多签名和个人钱包中被盗。一个月后，Truflation攻击者将137万DAI交换为500 ETH，并将其转移到Exch。

In August 2024, an address involved in a phishing attack transferred 300 ETH to the eXch platform after stealing 55.4 million DAI.

2024年8月，涉及网络钓鱼袭击的讲话将300 ETH转移到了5,540万次DAI之后，将300 ETH转移到了Exch平台。

The hackers who attacked Bybit started laundering coins yesterday afternoon. In the past 30 hours, they have used a large number of addresses to use cross-chain exchange platforms/mixing platforms such as Chainflip,

袭击拜比特的黑客昨天下午开始洗钱。在过去的30个小时中，他们使用了大量地址使用跨链交换平台/混合平台，例如Chainflip，