Germany seizes 47 crypto exchanges used by ransomware gangs

German law enforcement has seized 47 cryptocurrency exchanges located in the country that facilitated illegal money laundering activities for cybercriminals, including ransomware gangs.

The platforms allowed users to trade cryptocurrencies without having to adhere to the applicable ‘Know Your Customer’ regulations. This meant that users remained completely anonymous when making transactions.

This created a low-risk environment for cybercriminals to launder their proceeds without fear of prosecution or tracing.

“Exchange services that enable such anonymous financial transactions and thus money laundering are one of the most important building blocks in the criminal value chain of the cybercrime phenomenon,” according to a statement from the Federal Criminal Police (BKA).

“Users include ransomware groups, darknet dealers, and botnet operators who use such services to bring extorted ransoms or other criminal proceeds into the regular currency cycle, to leverage the money obtained through criminal means.”

On the trail of the users

When you visit any of the seized exchanges, you will now be redirected to a warning page titled “Operation Final Exchange,” which warns visitors that they have been deceived by promises of anonymity from the operators of these platforms.

“For years, the operators of these criminal exchanges have led us to believe that their hosting is untraceable, that they do not store customer data, and that all data is deleted immediately after the transaction,” Operation Final Exchange’s website states.

“A seemingly unregulated hub where you can launder the proceeds of your criminal activities without fear of prosecution.”

“We found and seized their servers – development servers, production servers, backup servers. We have their data – and therefore we have your data. Transactions, registration data, IP addresses.”

Authorities have secured extensive user and transaction data from the platforms, which could be useful in future investigations. It is expected that more cybercriminals will be arrested in the coming period as a result of this operation.

The full list of seized exchanges can be found on the Final Exchange portal, but the most common seized exchanges are:

• Xchange.cash – more than 410,000 users and 1,280,000 transactions
• 60cek.org – more than 300,000 users and 900,000 transactions
• Bankcomat.com – more than 250,000 users and 760,000 transactions
• Banksman.com – more than 280,000 users and 750,000 transactions
• Prostocash.com – more than 265,000 users and 470,000 transactions
• Multichange.net – more than 185,000 users and 430,000 transactions

So far, no arrests have been reported in connection with Operation Final Exchange. BKA noted that identified cybercriminals are often tolerated or protected by the country in which they reside, suggesting they are out of reach.

However, the law enforcement agency noted that the operators of the seized exchanges are being charged with money laundering and running illegal internet trading platforms under Sections 127 and 261 of the German Criminal Code (StGB). Prison sentences of several years could be imposed for this.