TL;DR
Blockchain investigator ZachXBT linked more than $20 million in suspected illicit funds to FreedomXMR (FXMR), a Monero swap service operating through Hyperliquid Core.
More than 87% of the service’s recorded inflows reportedly came from sources associated with hacks, ransomware, malware, and social engineering.
The investigation raises questions about safeguards on permissionless crypto platforms while highlighting the importance of onchain transparency, independent investigations, and responsible infrastructure development .
Blockchain investigator ZachXBT has identified a suspected cryptocurrency laundering operation involving more than $20 million in funds linked to cybercrime . The service, FreedomXMR (FXMR), appeared on Hyperliquid Core in August 2026 and uses Monero (XMR) , a cryptocurrency designed to enhance transaction privacy.
According to ZachXBT’s investigation, more than 87% of FreedomXMR’s recorded inflows were associated with illicit activity . The findings cover transactions connected to ransomware, software exploits, malware, and social engineering attacks, raising questions about how bad actors can exploit open blockchain infrastructure.
The investigator manually reviewed historical inflows exceeding $10,000 per transaction. He identified funds associated with the September exploits involving DCENT Wallet, Fetch.ai, and Axelar , as well as an undisclosed ransomware payment and the October Gamdom exploit.
How FreedomXMR Operated Through Hyperliquid Core
ZachXBT reported that the service’s operators sourced Monero liquidity through KuCoin, with more than 3,000 deposits identified in the exchange-related activity . The investigator suspects FreedomXMR uses a conversion model similar to Wagyu, although the complete operational structure has not been independently established.
The FXMR ticker was acquired through a Hyperliquid auction on July 27, 2026, for 518.28 HYPE . The purchase cost approximately $28,000 to $31,000, depending on the valuation used. The service subsequently appeared on Hyperliquid Core in August.
Hyperliquid’s permissionless architecture allows users to deploy spot tokens through its HIP-1 framework, with ticker deployment rights allocated through a Dutch auction. This structure lowers barriers for developers and supports open market access without conventional listing approvals . However, permissionless deployment does not establish the legitimacy of a token or the businesses operating around it.
ZachXBT said he had shared a spreadsheet containing supporting transaction data with the Hyperliquid team. He also pointed to previous centralized services, including b1exch, that allegedly exploited the platform’s open design. In a separate case earlier in October, the investigator reported freezing approximately $170,000 associated with the Bitget exploit at a service operating on Hyperliquid Core.
The findings illustrate a distinction between decentralized financial infrastructure and the conduct of individual operators. An open protocol can support legitimate trading, asset issuance, and financial experimentation while still attracting services that attempt to conceal the origins of stolen funds.
