ZachXBT Traces Over $20M in Illicit Flows Through FreedomXMR on Hyperliquid

On-chain investigator ZachXBT published a report on October 20 identifying FreedomXMR (FXMR), a swap service operating on Hyperliquid Core, as a centralized money-laundering operation whose inflows are overwhelmingly tied to crime. In the report, posted to his Telegram channel, ZachXBT writes that “more than 87% of its inflow volume is tied directly to illicit activity.” A manual review of every historical FXMR inflow above $10,000, he adds, traced more than $20 million to ransomware, exploits, malware and social-engineering attacks.

The allegation is directed at the operators of FreedomXMR, not at Hyperliquid, and ZachXBT says he has passed his source data to the Hyperliquid team. What the report does is surface the compliance tension at the core of permissionless exchanges: a chain built with no gatekeeper lets a service win a ticker and begin swapping deposited funds for Monero within hours, while the anti-money-laundering obligations that bind licensed venues have no obvious place to attach.

What FreedomXMR Is, and How It Moved Money

FreedomXMR “appeared on Hyperliquid Core in August 2026,” according to the report, and its name is descriptive: the service swaps deposited assets for Monero, the privacy-focused cryptocurrency that complicates downstream tracing. ZachXBT describes the mechanics as a swap model “similar to Wagyu’s,” in which a customer sends one asset and the operator returns another, the Monero leg obscuring where the funds came from on the way out.

The Monero did not materialize from nowhere. “The admin sources $XMR liquidity from KuCoin,” the report states, “with 3K+ deposits to KuCoin.” That detail matters because it places a licensed, compliance-bound exchange somewhere in the supply chain of a service the investigator calls a launderer. The report does not allege that KuCoin knowingly facilitated the activity, and the exchange is not accused of wrongdoing. The deposits are offered as the mechanism by which the operator obtained the privacy coin it paid out, not as evidence of intent on the exchange’s part.

Five Exploits, One Destination

The $20 million figure is assembled from individual incidents rather than a single breach. ZachXBT writes that a “manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents.” The incidents he lists stretch across two months: the DCENT Wallet exploit in September 2026, the Fetch.ai exploit in September 2026, the Axelar exploit in September 2026, an unnamed ransomware payment in September 2026, and the Gamdom exploit in October 2026.

That is the pattern a compliance analyst would recognize immediately: a single destination receiving the proceeds of multiple, unrelated attacks is the signature of a laundering rail, not a legitimate trading desk. The report also identifies the FXMR hot wallet at 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 and lists three additional administrator-controlled addresses, giving exchanges and the Hyperliquid team a concrete set of labels to act on.

The $28,000 Ticker and the Economics of Entry

The most striking detail is how cheaply the operation set itself up. “The FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 $HYPE ($28K),” the report states. The arithmetic is plain: paying 518.28 $HYPE for $28,000 implies a $HYPE price of about $54 at the time of the auction. With $HYPE trading near $81.67 on October 21, per Binance market data, that same stake would now be worth roughly $42,300, an appreciation of more than 50 percent even before any proceeds from the laundering business itself.

Set the $28,000 entry cost against the more than $20 million in traced illicit inflows and the gap is a multiplier of roughly 700-to-one: a four-figure ticker purchase became the gateway to an eight-figure flow of tainted funds. That ratio is the report’s quietest argument, because it shows how the permissionless listing mechanism that makes Hyperliquid fast and cheap to build on also makes it cheap for a bad actor to obtain a branded on-chain destination.

The pattern is not new to Hyperliquid. “HL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption,” ZachXBT writes. The earlier congressional interest in the exchange, including an expanding insider-trading probe that already names Hyperliquid, means the platform is now being watched on two fronts at once: market integrity and anti-money-laundering.

What the Report Establishes, and What It Does Not

The report is an on-chain tracing exercise, not a court finding. ZachXBT’s $20 million figure covers only inflows above the $10,000 threshold he reviewed, which means the full lifetime volume through FreedomXMR is larger than the number he documents. His “more than 87%” claim is a share of inflow volume, not a share of all activity, and neither figure constitutes a legal determination that any specific person committed a crime.

The same caution applies in the other direction. The report does not allege wrongdoing by Hyperliquid, whose listing mechanism is permissionless by design, or by KuCoin, which appears in the report only as a source of $XMR liquidity. A neutral reading is that the investigation names the service and its operators, supplies on-chain evidence, and hands that evidence to the platform most able to freeze or delist the offending contracts.

What the report cannot yet answer is whether the named wallets have been frozen, whether Hyperliquid will delist FXMR, and whether any exchange will act on the addresses. Those are the next observable steps, and they will determine whether the investigation produces an enforcement outcome or remains a published warning.

What Happens If the Chain Does Not Act

The pressure now flows in two directions. First, Hyperliquid must decide whether to freeze or delist FXMR and any associated accounts, a decision with precedent-setting weight for how the chain treats similar services in the future. Second, the exchanges and entities that touch the identified addresses, including the Monero leg through KuCoin, face the standard obligation to risk-score the exposure and, where required, file suspicious activity reports.

For the broader decentralized-exchange sector, the report is a case study in a recurring problem: permissionless listing lowers the barrier for legitimate teams and for launderers alike. The regulatory answer that has worked for centralized venues, mandatory KYC and transaction monitoring, does not transfer cleanly to a chain that settles trades without custody. Until that gap is closed, investigators like ZachXBT are functioning as an unofficial compliance layer, and the platforms they inform remain the only party in a position to act quickly.

Monero’s role is the final, uncomfortable thread. The service chose Monero precisely because its transaction graph resists the tracing ZachXBT performed on the Hyperliquid side. That is a reminder that the AML exposure described here is not an abstract DeFi problem; it is the specific intersection of a permissionless market and a privacy asset designed to defeat the very transparency that made this report possible. $HYPE, the token at the center of that market, was itself only recently drawn into the public eye when Binance listed it, and the investigation lands against that same backdrop of mainstream exchange adoption.

The cleanest read of the report is narrower than the headlines suggest. A service with an 87 percent illicit inflow share operated on Hyperliquid Core for roughly two months, moved more than $20 million in traced tainted funds, and did so on a ticker that cost its operator $28,000. The investigation names wallets, documents five source incidents, and hands the evidence to the platform. What it does not yet produce is a freeze, a delisting, or a filing. Those are the events to watch next.