ZachXBT Links 87% of FreedomXMR Inflows to Illicit Funds

Blockchain investigator ZachXBT has linked more than 87% of inflows into FreedomXMR, a cryptocurrency exchange service operating on Hyperliquid Core, to suspected illicit activity, according to CryptoNews. The analysis traced over $20 million to ransomware, exploits, malware, and social engineering attacks.

The investigation identified transactions involving incidents at DCENT Wallet, Fetch.ai, Axelar, and Gamdom. ZachXBT also connected the service's Monero liquidity to KuCoin, identifying more than 3,000 exchange deposits.

Investigation Details and Methodology

In an October 20 investigation, ZachXBT identified FreedomXMR, known as FXMR, as a centralized laundering service that emerged on Hyperliquid Core in August 2026. His analysis covered historical incoming transactions exceeding $10,000 each. The $20 million figure represents funds traced to identified incidents among transactions above this review threshold, though the report does not establish the service's complete lifetime transaction volume.

The investigator identified 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 as the FXMR hot wallet and listed three additional addresses as administrator-controlled wallets. The FXMR ticker was acquired for 518.28 HYPE on July 27 through a Dutch auction under Hyperliquid's permissionless HIP-1 listing model.

KuCoin and Monero Scrutiny

The investigation alleges that the administrator obtained Monero liquidity through KuCoin, identifying over 3,000 deposits from associated addresses. The report notes that Monero's privacy-focused features obscure transaction details, though the KuCoin transfers do not establish that the exchange knowingly participated in laundering activity.

ZachXBT stated he shared a spreadsheet containing supporting blockchain data with the Hyperliquid team. The protocol's official announcements state that user-deployed spot assets are not endorsed by the development team.

Key facts

• More than 87% of FreedomXMR inflows on Hyperliquid Core are linked to illicit activity, according to ZachXBT.
• Over $20 million was traced to ransomware, exploits, malware, and social engineering attacks.
• Identified incidents include attacks involving DCENT Wallet, Fetch.ai, Axelar, and Gamdom.
• The FXMR ticker was acquired for 518.28 HYPE in a July 27 auction before the service appeared in August.