ZachXBT links over 87% of FreedomXMR inflows on Hyperliquid to illicit funds
Blockchain investigator ZachXBT has linked more than 87% of inflows into FreedomXMR, a cryptocurrency exchange service operating on Hyperliquid Core, to suspected illicit activity, with over $20 million traced to cybercrime-related sources.
- ZachXBT says more than 87% of funds entering FreedomXMR on Hyperliquid Core are linked to illicit activity.
- The investigator traced over $20 million to ransomware, exploits, malware and social engineering attacks.
- The identified incidents include attacks involving DCENT Wallet, Fetch.ai, Axelar and Gamdom.
- ZachXBT linked the service’s Monero liquidity to KuCoin and identified more than 3,000 exchange deposits.
- The FXMR ticker was acquired for 518.28 HYPE on July 27, before the service reportedly appeared in August.
In an October 20 investigation, ZachXBT identified FreedomXMR, known as FXMR, as a centralized laundering service that emerged on Hyperliquid Core in August 2026. His analysis covered historical incoming transactions exceeding $10,000 each.
The investigator connected the funds to ransomware payments, cryptocurrency exploits, malware and social engineering attacks.
ZachXBT traces $20 million in suspected illicit inflows
According to ZachXBT, the identified transactions include proceeds linked to the September 2026 incidents involving DCENT Wallet, Fetch.ai and Axelar, alongside an unnamed ransomware payment from the same month.
Funds associated with an October exploit involving online gambling platform Gamdom were identified among the incoming transfers.
The investigator stated that “more than 87% of its inflow volume is tied directly to illicit activity,” describing the service as one of several centralized operators using Hyperliquid’s infrastructure.
The $20 million figure represents the amount he traced to identified incidents among transactions above the $10,000 review threshold. His published statement does not establish the service’s complete lifetime transaction volume or independently document every source attribution.
ZachXBT identified 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 as the FXMR hot wallet and listed three additional addresses as administrator-controlled wallets.
KuCoin deposits and Monero liquidity draw scrutiny
The investigation further alleges that the administrator obtained Monero (XMR) liquidity through KuCoin.
ZachXBT identified more than 3,000 deposits to the cryptocurrency exchange from associated addresses and suggested that FXMR uses a swapping arrangement similar to Wagyu, another service he referenced.
Monero is a privacy-focused cryptocurrency that obscures certain transaction details. Its use can make tracing funds after conversion more difficult, although an XMR transaction does not by itself demonstrate criminal conduct.
The reported KuCoin transfers do not establish that the exchange knowingly participated in the alleged laundering activity.
KuCoin has faced questions over suspicious transfers in previous investigations. In June, ZachXBT raised concerns about stolen funds linked to five alleged deposit addresses at the exchange following a reported USD 250,000 theft.
Separately, an investigation involving Monero transfers traced USD 120.2 million in USDT through several cryptocurrency services, including KuCoin. Tether subsequently froze USD 72.03 million associated with the case. Neither investigation establishes wrongdoing by KuCoin in connection with FreedomXMR.
Hyperliquid’s permissionless listing model faces scrutiny
FreedomXMR reportedly secured the FXMR ticker through a Hyperliquid auction on July 27, paying 518.28 HYPE, valued at approximately $28,000 at the time.
Hyperliquid’s HIP-1 documentation confirms that token deployment uses a Dutch auction, allowing participants to acquire deployment rights without obtaining permission from a centralized listing committee.
The protocol’s official announcements explicitly state that user-deployed spot assets are not endorsed by the development team.
ZachXBT compared FXMR with b1exch, another alleged centralized laundering service he said had previously operated on Hyperliquid Core.
Moreover, ZachXBT has documented similar concerns in investigations involving stolen cryptocurrency moving through several services. An October report on the Bybit hack described his findings on an alleged laundering network connected to the 2025 exploit, including more than USD 12 million in traced funds.
The investigator said he had shared a spreadsheet containing supporting blockchain data with the Hyperliquid team. He did not report any resulting enforcement action, account restrictions or formal response from the protocol.
