Investigation Overview
Recently, blockchain investigator ZachXBT conducted a thorough examination revealing that an alarming 87% of the funds flowing into FreedomXMR, a cryptocurrency exchange service built on the Hyperliquid Core platform, are likely connected to criminal activities. This investigation, released on October 20, highlights that over $20 million in transactions have been traced back to various cybercrime sources associated with the platform’s operations since its launch in August 2026.
Key Findings
In his analysis, ZachXBT scrutinized transactions exceeding $10,000 and found that these funds were broadly associated with ransomware activities, security breaches involving cryptocurrencies, malware implementations, and tactics related to social engineering. Among the highlighted incidents were notables from September 2026, including issues tied to DCENT Wallet, Fetch.ai, and Axelar, as well as a significant payment related to a ransomware incident that month. Additionally, funds implicated in an October exploit related to the online gambling platform Gamdom were also identified among these transactions.
Characterization of FreedomXMR
ZachXBT characterized FreedomXMR, often referred to as FXMR, as a central player in cryptocurrency laundering, attributing a substantial portion of its inflow volume to deliberate illicit conduct. Specifically, he pointed out that the vast majority—over 87%—of FXMR’s total inflows are traceable to suspicious activities. This service is one among several entities utilizing the infrastructure provided by Hyperliquid.
Wallet Analysis
Further analysis identified a specific wallet, 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2, belonging to FXMR, along with three other admin-controlled addresses. The investigation suggested that the administration accrued Monero (XMR) liquidity via KuCoin, another cryptocurrency exchange. Over 3,000 deposits to FXMR originated from these connected addresses, with implications that FXMR employs a currency swapping method akin to that of Wagyu, another previously referenced exchange.
Monero and KuCoin Transfers
Monero is a cryptocurrency designed to enhance privacy by obfuscating transaction details, which complicates tracing efforts once funds are converted. It is critical to note that merely moving XMR does not automatically imply criminal activity. The KuCoin transfers have not definitively proved the exchange’s involvement in alleged money laundering activities. In fact, KuCoin itself has faced scrutiny in past investigations regarding suspicious transfers; an earlier case raised by ZachXBT in June concerned unauthorized funds linked to five deposit addresses on the platform.
Moreover, another investigation suggested that Monero transfers resulted in tracing USD 120.2 million in USDT across multiple crypto platforms, including KuCoin. In response, Tether froze about USD 72.03 million associated with these transactions. Importantly, neither existing investigation implicates KuCoin in any wrongdoing linked to FreedomXMR.
Acquisition of FXMR Ticker
The FXMR ticker was reportedly obtained through a Hyperliquid auction held on July 27, during which it paid 518.28 HYPE, amounting to roughly $28,000 at the time. Hyperliquid’s HIP-1 documentation affirms that its token deployment follows a Dutch auction model, facilitating acquisition rights without centralized oversight.
Similarities to Other Platforms
Additionally, ZachXBT noted similarities between FXMR and b1exch, another suspected centralized laundering platform that previously operated on Hyperliquid. His body of work has often highlighted issues surrounding stolen cryptocurrency, evidenced in an October report detailing a laundering scheme connected to a 2025 incident involving Bybit which traced over USD 12 million in illicit funds.
Conclusion
ZachXBT has provided Hyperliquid’s team with a spreadsheet detailing blockchain evidence supporting his findings, but as of his report, there has been no indication of enforcement actions or responses from the Hyperliquid protocol regarding these serious allegations.
