Quick answer: On Oct. 20, 2026, investigator ZachXBT reported that more than 87% of inflow volume to FreedomXMR (FXMR), a swap service on Hyperliquid Core since August, ties directly to illicit activity. Reviewing inflows above $10,000, he traced over $20 million to ransomware, exploits, malware and social engineering, per his Investigations channel.
A swap service that appeared on Hyperliquid only two months ago is now accused of being a cash-out route for hackers. On Oct. 20, 2026, on-chain investigator ZachXBT said FreedomXMR has taken in more than $20 million tied to ransomware, exploits and scams, and paid it out as Monero.
The report lands as privacy coins rally and permissionless chains face fresh questions about who uses their rails.
What did ZachXBT find about FreedomXMR?
ZachXBT posted the findings on his Investigations Telegram channel at 12:05 UTC on Oct. 20. He called FreedomXMR, which trades under the FXMR ticker, “a new centralized laundering service” that launched on Hyperliquid Core in August 2026.
“More than 87% of its inflow volume is tied directly to illicit activity,” he wrote. A manual review of all historical FXMR inflows above $10,000 traced over $20 million to five incidents:
- the DCENT Wallet exploit (September 2026)
- the Fetch.ai exploit (September 2026)
- the Axelar exploit (September 2026)
- an unnamed ransomware payment (September 2026)
- the Gamdom exploit (October 2026)
He also published the FXMR hot wallet address and three addresses he attributes to the admin. Wu Blockchain and The Block relayed the findings within two hours.
How does the FreedomXMR swap service work?
Per ZachXBT, users send in tokens and receive Monero (XMR) back, in a model “similar to Wagyu’s.” Monero hides senders, receivers and amounts, so the trail usually goes cold once funds are swapped. That is why stolen funds keep seeking XMR exits, as we saw when the Monero price topped $600 earlier this week.
He says the admin sources XMR liquidity from KuCoin, with more than 3,000 deposits from linked addresses. That does not show KuCoin knew of or took part in the activity. It shows where the operator may have bought its Monero.
Why does Hyperliquid keep hosting these services?
Hyperliquid Core is permissionless. Anyone can win a ticker in a Dutch auction and deploy an asset, as its HIP-1 documentation explains. ZachXBT says the FXMR ticker was bought on July 27, 2026 for 518.28 HYPE, about $28,000 at the time.
He added that other centralized laundering services, such as b1exch, have abused the chain’s “permissionless design and adoption.” He has shared a spreadsheet of source data with the Hyperliquid team. As of 08:50 UTC on Oct. 21, neither Hyperliquid nor KuCoin had posted a public reply that we could find.
What are the market implications for HYPE and XMR?
So far, traders have shrugged. HYPE traded near $81.45, up 4.1% in 24 hours, while XMR sat near $584.58, down 4.8%, per CoinGecko at 08:51 UTC on Oct. 21.
The bigger risk is regulatory, not price. Hyperliquid has grown fast on new products such as Pump.fun’s 40x perps. Repeated laundering cases give regulators and exchanges a reason to push for listing checks or address screening. Meanwhile, hacks keep feeding these pipes. Q3 crypto hacks hit $1.18 billion, and big exploiters still move funds through mixers, as the Drift exploiter did with Tornado Cash.
What should users and traders watch next?
Watch for three things. First, whether Hyperliquid acts on the shared data, for example by delisting FXMR or flagging its addresses in front ends. Second, whether KuCoin freezes deposits linked to the admin wallets. Third, whether victims such as Gamdom or Axelar confirm the traced amounts.
If you hold assets on Hyperliquid, nothing in the report points to a risk for ordinary users. The concern is about who uses the chain, not its solvency.
FreedomXMR FAQ
What is FreedomXMR?
FreedomXMR, or FXMR, is a swap service on Hyperliquid Core that launched in August 2026 and pays users in Monero. On Oct. 20, 2026, ZachXBT called it a centralized laundering service and said more than 87% of its inflow volume ties to illicit activity.
How much money did ZachXBT trace to FreedomXMR?
He traced more than $20 million in inflows above $10,000 to ransomware, exploits, malware and social engineering. Named incidents include DCENT Wallet, Fetch.ai, Axelar and Gamdom. The figure covers only the larger transfers he reviewed, not the service’s full volume.
Is KuCoin involved in FreedomXMR?
ZachXBT says the FXMR admin sourced Monero through more than 3,000 KuCoin deposits. That alone does not show KuCoin knew about or took part in any laundering, and KuCoin had not commented publicly as of Oct. 21, 2026.
Is Hyperliquid safe to use after the FreedomXMR report?
The report concerns one third-party service on Hyperliquid Core, not a hack or solvency issue at Hyperliquid itself. ZachXBT shared his data with the Hyperliquid team, which had not responded publicly by 08:50 UTC on Oct. 21, 2026.
Not financial advice. Allegations are ZachXBT’s and have not been tested in court. Always DYOR.
