Blockchain forensics firm TRM Labs claims that the Crypto exchange exchange is still operating despite the announcement of its shutdown. The firm analysts revealed this in a new report, pointing to the on-chain activity.
The exch announced that it would be closed on May 1 due to allegations that it helped laundering hackers part of the $ 1.4 billion stolen from Bybit in February. Although the exchange has rejected the allegations, it still said it would close the April 17 statement.
According to the planned shutdown, the exch closed some of its infrastructure throughout April. This includes removing four dark web and ClearNet domain on April 30 and ending support for its browser interface on April 27.
In spite of all these changes, TRM LABS ANALYSTS The reported on-chain activity suggests that some of the exch infrastructure are still in contact with funds associated with actors who are threat to sexual abuse (CSAM).
It said:
“The TRM noticed the on-chain activity on April 30, 2025 as we had previously identified as Halo-Pool's operations exposed to CSAM. This infrastructure has remained active and contacted newly removed funds linked to CSAM for many days.”
The firm noted that this on-chain activity suggests that the platform can be active even if it now operates in secret. It added that the exch itself said it would still offer an interface of Application Programming (API) interface to partners, and that the bad actor could still use this infrastructure.
Halo -Hallang pools are centered on exch operating
Meanwhile. It allows the exchange to hide the resource and destination of the property, which makes it more difficult to monitor the funds transferred to the exchange.
The mix -up pools are like replacement services where users can deposit one coin and change for another. Because all the deposits of the same coin are combined and used as liquidity for backward, it is possible for legitimate and prohibited funds to mix, and for anyone who retreats.
The firm added that there is no sign that the exch is reviewing the source of incoming funds, and its infrastructure system is unclear, making it easy for evil actors to rely on it for the transfer of funds.
However, Exch claimed its goal to support privacy and not serve criminals and forgive illicit activities. Despite this, the TRM Labs noted that the exchange has refused to help the BYBIT funds, which is likely to be connected to the $ 1.4 billion hack, a decision that puts it in attention.
Blockchain forensic analysts believe that the exchange facilitates illicit transactions before the Bybit incident. According to TRM analysts, the exch is the leading exchange for the transfer of CSAM -related funds, with over $ 300,000 in those funds deposited in exchange.
It added that CSAM funds have even helped to provide liquidity for bybit hackers to change property when they use the exchange to eliminate stolen funds.
What's next for the exch?
It is unclear what the exchange plan to do next. Although it announced a shutdown, the on-chain activity shows that it is still operating, which increases doubts about the platform's intent.
According to the TRM Labs, the exchange has removed all communications regarding its shutdown several hours after posting it on April 27 and operating again on April 28. The company believes that these mixing communications may be due to internal disagreements between platform stakeholders or just a plan to get the public behind it.
Noteworthy, the exchange also said it will shift its infrastructure management to another team by May 1, while the original team will remain in a consultant capacity and provide recommendations.
This transition indicates a possible rebrand of exchange, especially as part of the recommendation is for the exch to create dedicated pools of liquidity. TRM analysts believe it is a plan to hide on-chain connections in previous activity.
Cryptopolitan Academy: Wanna grow your money in 2025? Learn how to do this with Defi on our upcoming webclass. I -save your place
