Xeggex Exchange Collapses After Suspicious Withdrawals

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Xeggex Logo/Homepage

Summary.

About Xeggex

Xeggex built its reputation as a haven for low-cap tokens and regulatory avoidance. Xeggex claimed to offer a comprehensive suite of services tailored to cryptocurrency traders and investors. The platform provided access to Spot Markets, where users can buy and sell over 450 different assets across more than 1,100 markets. The interface was designed for simplicity, making it accessible for both novice and experienced traders. This allowed users to engage in trading activities with ease and efficiency. Additionally, Xeggex offered Liquidity Pools, which enable users to provide liquidity and earn rewards from transaction fees and other bonuses generated by the platform's activities.

The platform also facilitated Peer-to-Peer (P2P) Trading, allowing users to trade cryptocurrencies directly with one another globally, with a very low fee of just 0.2%. This provided greater flexibility for traders who prefer dealing with peers rather than through centralized exchanges. For users interested in digital art and collectibles, Xeggex hosted an NFT Marketplace, where individuals can discover, buy, and sell NFTs, expanding their trading opportunities beyond traditional cryptocurrencies. Furthermore, the platform included Faucets, enabling users to claim free cryptocurrency or create faucets to promote certain assets.

A key feature that Xeggex promoted is its native XPE Token, which offers various benefits. By holding XPE tokens in their accounts, users could reduce their trading and withdrawal fees, pay for liquidity pool participation, and promote their assets on the platform. The use of XPE can save users up to 25% on fees, making it an attractive incentive for active traders. This native token is central to Xeggex's ecosystem and aimed to enhance the overall user experience by offering financial savings and additional utility across the platform.

To cater to the needs of on-the-go traders, Xeggex also offers a mobile app available for both Android and iOS devices, allowing users to trade conveniently from their smartphones. The platform's emphasis on ultra-low fees was a significant selling point, especially for those who choose to use XPE tokens for fee payments. Lastly, Xeggex provided a variety of market pairs, from popular cryptocurrencies like Bitcoin and Ethereum to lesser-known altcoins, ensuring a diverse range of trading opportunities for all types of users.

The Reality

It is alleged that the Xeggex platform was actually operated by Paul Vernon.

The Xeggex platform reportedly managed large financial transactions using MongoDB.

Suspicious transfers were detected before the hack announcement, and blockchain analysis showed millions in altcoins locked in wallets, with some remaining untouched for weeks.

What Happened

Starting on February 3rd, 2025, users no longer had access to their funds. The platform claimed technical difficulties after its CEO's account was allegedly "hacked" and the database corrupted.

Key Event Timeline - Xeggex Exchange Collapses

Date	Event	Description
January 11th, 2025 9:12:00 PM MST	Xeggex Ignores 2FA Vulnerability	According to Twitter/X user Foquismo_, they reported an issue with the 2FA system in Xeggex at this time. The Xeggex team reportedly "informed[ them] that such an event was impossible and that [they] must have made an error, asserting that Xeggex was 100% secure".
February 3rd, 2025 2:34:00 AM MST	Xeggex Announces CEO Hacked	Xeggex posts on Twitter/X to announce that their CEO had their Telegram account hacked.
February 6th, 2025 1:18:00 PM MST	James Tylee Telegram Muted	James Tylee reports that he is muted from the official Xeggex Telegram group chat, shortly after providing commands which can assist with recovering the MongoDB database.
February 6th, 2025 3:04:00 PM MST	Using Percona Database	A screenshot of Telegram chat reports that the exchange team is claiming that the expert they were meeting with is unable to help them because they are using Percona database rather than MongoDB.
March 5th, 2025 9:42:00 AM MST	Rekt News Article Published	Rekt shares an article summarizing the Xeggex situation, reporting the sudden collapse of the altcoin exchange amid claims of a "hack" and database corruption. The timing of the incident raised suspicions, as millions in funds appeared to have been moved before the alleged hack, and wallet activity continued despite the exchange's claims of technical difficulties. Users were eventually given "promissory tokens" in place of real assets, and investigations into the collapse revealed similarities to past exchange failures, particularly Cryptsy and Altilly. The article suggests a pattern of exit scams orchestrated by operators who drain assets, fabricate technical issues, and delay recovery, leaving users with empty promises.

Technical Details

The situation mirrors previous exchange collapses, such as Cryptsy and Altilly, with shared patterns of "hacks," database failures, and indefinite recovery promises. Community investigations suggest potential links to Paul Vernon, the figure behind Cryptsy's collapse.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

Xeggex posted an initial update on their Twitter/X account shortly after disabling withdrawals:

Dear users, in this hard time our CEO was hacked and he lost tg account and xeggex community group beside that we still don't know details about it. Also what is important in this moment is that we succeed to lock down wallets so funds are safe. Problem with logins is still there due that we disconnected database from the network and we will go in the background to examine everything.. Next news will be more detailed after we get wider picture.

Users criticized the platform's use of MongoDB.

I also question why they are using Mongo, or any NoSql / document db for that matter. IMO, With something as critical as financial transactions and a significant user base, they should be using a real relational db and have a proper DR and Business Continuity plans, along with periodic testing of those processes so they are prepared to handle this type of situation.

Despite claiming technical issues, the exchange's wallets continued to show activity, particularly with Pepe transactions.

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Reported Attempts To Resolve Database Issue

Geraldo from the Xeggex team reported that they had met with a team to discuss their database at 4 AM:

"We had the call at 4am EST to get synced up with them on the situation. They were under the impression we used MongoDB Community, but we use Percona. Sounds like it might not be an issue, but it is/was. So they need a different set of people that would assist with that particula[r] distributeion. Aside from that, we are looking at other approaches."

Replacement Of Assets With Promissory Notes

Xeggex users discovered "promissory tokens" replacing real assets in their accounts, offering little recourse for users trying to withdraw or trade.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Users were granted promissory notes in place of assets they previously held.

Ongoing Developments

The situation remains ongoing. As the investigation deepens, users and crypto sleuths question whether Xeggex’s collapse was a carefully orchestrated exit scam, following a pattern of draining assets, fabricating technical issues, and stringing users along with false recovery promises.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

When using any third party custodial platform (such as for trading), it is important to verify that the platform has a full backing of all assets, and that assets have been secured in a proper multi-signature wallet held by several trusted and trained individuals. If this can't be validated, then users should avoid using that platform. Unfortunately, most centralized platforms today still do not provide the level of transparency and third party validation which would be necessary to ensure that assets have been kept secure and properly backed. Therefore, the most effective strategy at present remains to learn proper self custody practices and avoid using any third party custodial platforms whenever possible.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.