ZachXBT: Over $20M of Illicit Funds Moved Through FreedomXMR

On-chain investigator ZachXBT published a report on Oct. 20 on FreedomXMR, a service running on Hyperliquid Core, saying more than $20 million of illicit funds passed through it and that over 87% of its inflows were illicit. The service appeared in August 2026 and works like a swap desk: users deposit one asset and receive Monero (XMR).

Details

ZachXBT manually reviewed transactions above $10,000 and tied them to ransomware, exploits, malware distribution and social engineering. According to Crypto Briefing, the flows were linked to the DCENT Wallet, Fetch.ai and Axelar exploits in September, the Gamdom exploit in October and an unnamed ransomware payment. The original post is in his Telegram channel.

ZachXBT says the operator sourced XMR liquidity through KuCoin, with more than 3,000 deposits traced to service-linked addresses; the findings do not allege wrongdoing by KuCoin itself. The operator won the FXMR ticker in a Hyperliquid auction on July 27 for 518.28 HYPE (roughly $28,000⁠–⁠31,000 depending on the outlet), Bankless reports. He shared the data with the Hyperliquid team, which had not responded publicly at the time of Bankless's report.

What it means for the market

The case highlights a weak spot of permissionless venues: anyone can win a ticker and launch a swap service within hours, while the anti-money-laundering rules that bind licensed exchanges have no obvious place to attach. It is not the first time stolen funds have moved into privacy assets; see our recent note on hackers routing loot through Zcash.

For HYPE and XMR holders the open question is whether and how Hyperliquid responds; no confirmed measures yet. Live prices are in the daily brief.