ZachXBT Flags $20M Monero Laundering Service on Hyperliquid
ZachXBT Uncovers $20M+ Monero Laundering Pipeline on Hyperliquid Called FreedomXMR
On-chain investigator ZachXBT has flagged a service called FreedomXMR (FXMR) operating on Hyperliquid Core as a major laundering pipeline. Since it appeared in August 2026, more than 87% of its inflows have been tied to illicit activity, with over $20 million traced to ransomware, hacks, malware, and social engineering attacks.
What Is FreedomXMR?
FreedomXMR is a centralized swap service on Hyperliquid Core that lets users deposit assets and receive Monero (XMR) in return. Monero is a privacy-focused cryptocurrency designed to hide transaction details, making it harder to track funds after they leave the service.
ZachXBT describes it as a centralized laundering operation rather than a normal trading desk. He says the operators source Monero liquidity mainly through KuCoin, with more than 3,000 deposits linked to associated addresses. The setup appears similar to another service called Wagyu.
Key Findings from the Investigation
ZachXBT manually reviewed historical inflows larger than $10,000. He traced more than $20 million directly to criminal sources. The 87% figure refers to the share of inflow volume (by value) linked to illicit activity.
Specific incidents connected to the inflows include:
- DCENT Wallet exploit (September 2026)
- Fetch.ai exploit (September 2026)
- Axelar exploit (September 2026)
- An unnamed ransomware payment (September 2026)
- Gamdom exploit (October 2026)
He also identified a primary hot wallet and several administrator-controlled addresses. ZachXBT shared the supporting on-chain data with the Hyperliquid team.
How the Service Got Started
The operators bought the FXMR ticker in a Hyperliquid auction on July 27, 2026, for 518.28 HYPE (roughly $28,000–$31,000 at the time). This gave them a branded presence on one of crypto’s busiest platforms with a relatively small upfront cost.
ZachXBT noted that other centralized laundering services (such as b1exch) have previously used Hyperliquid Core’s permissionless design in similar ways.
Why This Matters
Permissionless platforms like Hyperliquid make it easy and cheap for anyone to list a ticker and start operating. That speed is useful for legitimate projects, but it also lowers the barrier for services that primarily process tainted funds.
Monero’s privacy features are central here. Once funds are swapped into XMR, tracing becomes much harder. The investigation highlights the tension between open infrastructure and anti-money-laundering expectations that apply more clearly to regulated exchanges.
Note that the findings target the FreedomXMR operators, not Hyperliquid itself. The report is an on-chain tracing exercise based on public data—not a court ruling. The $20 million figure covers only the larger deposits ZachXBT reviewed, so total volume through the service is likely higher.
What Comes Next
Hyperliquid now has the data and can decide whether to freeze related activity, delist FXMR, or take other steps. Exchanges that touch the identified addresses (including those involved in the Monero liquidity side) may also review the exposure.
As of the latest reports, Hyperliquid had not issued a public response. Further actions—or lack of them—will show how the platform handles similar cases going forward.
This case is a clear example of how stolen crypto from multiple unrelated incidents can converge on one service that converts it into a privacy coin. ZachXBT’s work continues to surface these patterns quickly using on-chain evidence.