ZachXBT Says 87% of FreedomXMR Inflows on Hyperliquid Are Illicit Funds

Published October 20, 2026, 10:38 PM PKT. Based on ZachXBT's investigation published October 20, 2026 (primary source, via his published findings and data shared with the Hyperliquid team), with additional reporting from crypto.news and PANews (secondary sources).

Blockchain investigator ZachXBT said on October 20, 2026 that more than 87% of the funds flowing into FreedomXMR, a centralized exchange service operating on Hyperliquid Core, are tied directly to illicit activity, according to reporting by crypto.news and PANews based on his published investigation. ZachXBT identified FreedomXMR, also known as FXMR, as a centralized laundering service that emerged on Hyperliquid Core in August 2026. His analysis reviewed the service's historical incoming transactions above $10,000 each and concluded that "more than 87% of its inflow volume is tied directly to illicit activity," describing it as one of several centralized operators using Hyperliquid's infrastructure.

A $20 million trail across ransomware and exploits

Among the transactions he reviewed, ZachXBT traced more than $20 million to cybercrime-related sources, crypto.news reported. The identified incidents include proceeds linked to the September 2026 exploits involving DCENT Wallet, Fetch.ai and Axelar, alongside an unnamed ransomware payment from the same month. Funds associated with an October exploit involving the online gambling platform Gamdom were also identified among the incoming transfers, according to the report. The $20 million figure represents the amount he traced to identified incidents among transactions above the $10,000 review threshold, and his published statement does not establish the service's complete lifetime transaction volume or independently document every source attribution, crypto.news noted.

The KuCoin Monero liquidity line

The investigation also alleges that the service's administrator obtained Monero (XMR) liquidity through KuCoin. ZachXBT identified more than 3,000 deposits to the exchange from associated addresses and suggested that FreedomXMR uses a swapping arrangement similar to Wagyu, another service he referenced, according to the reporting. Monero is a privacy-focused cryptocurrency that obscures certain transaction details, so converting funds into it can make tracing harder after the fact, although an XMR transaction does not by itself demonstrate criminal conduct. The reported KuCoin transfers do not establish that the exchange knowingly participated in the alleged laundering activity, crypto.news noted. ZachXBT identified 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 as the FXMR hot wallet and listed three additional addresses as administrator-controlled wallets, according to the report.

How the ticker landed on Hyperliquid

FreedomXMR secured the FXMR ticker through a Hyperliquid auction on July 27, 2026, paying 518.28 HYPE, valued at approximately $28,000 at the time, according to PANews. Hyperliquid's HIP-1 documentation confirms that token deployment uses a Dutch auction, allowing participants to acquire deployment rights without permission from a centralized listing committee, and the protocol's official announcements explicitly state that user-deployed spot assets are not endorsed by the development team, crypto.news reported. ZachXBT compared FXMR with b1exch, another alleged centralized laundering service he said had previously operated on Hyperliquid Core. He said he had shared a spreadsheet containing supporting blockchain data with the Hyperliquid team, but did not report any resulting enforcement action, account restrictions or formal response from the protocol, according to the reporting.

This article is news reporting and is not investment advice.

Sources

• ZachXBT's investigation, published October 20, 2026, primary source: FreedomXMR (FXMR) identified as a centralized laundering service on Hyperliquid Core that emerged in August 2026; more than 87% of inflow volume tied directly to illicit activity; more than $20 million traced to ransomware, exploits, malware and social engineering attacks; named incidents DCENT Wallet, Fetch.ai, Axelar, an unnamed September ransomware payment and the Gamdom exploit; Monero liquidity sourced via KuCoin with more than 3,000 deposits from associated addresses; FXMR hot wallet 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 plus three administrator-controlled wallets; comparison with b1exch; blockchain data shared with the Hyperliquid team
• crypto.news (Olivia Stephanie), October 20, 2026, secondary source: summary of the investigation's findings, the $20 million traced figure and the $10,000 review threshold caveat, KuCoin/Wagyu detail, HIP-1 Dutch auction permissionless listing detail, protocol statement that user-deployed spot assets are not endorsed by the development team
• PANews, October 20, 2026, secondary source: DCENT Wallet, Fetch.ai, Axelar and Gamdom incident list; FXMR ticker purchased for 518.28 HYPE (about $28,000) in the July 27, 2026 Hyperliquid auction; swap model comparison with Wagyu; the service emerged on Hyperliquid Core in August 2026