More than 87% of incoming transaction volume to FreedomXMR, a cryptocurrency swapping service operating on Hyperliquid Core, is linked to suspected illicit activity, according to an investigation published by blockchain researcher ZachXBT on October 20, 2026. The investigator identified more than $20 million in deposits associated with ransomware payments, cryptocurrency exploits, malware and social-engineering attacks. FreedomXMR, also known as FXMR, reportedly began operating on Hyperliquid in August, offering cryptocurrency conversions involving privacy-focused asset Monero (XMR). ZachXBT characterized the operation as a centralized money-laundering service using decentralized blockchain infrastructure.
The findings raise questions about the ability of permissionless trading networks to identify suspicious operators, although the allegations concern a specific service rather than Hyperliquid’s overall transaction activity. The 87% figure represents the share of incoming value ZachXBT attributed to illicit sources, not the proportion of individual transactions or users involved in criminal activity.
More Than $20 Million Traced to Hacks and Ransomware
ZachXBT said he manually reviewed historical FreedomXMR deposits exceeding $10,000 per transaction, identifying more than $20 million originating from suspected criminal activity. The transactions included funds connected to September security incidents involving DCENT Wallet, Fetch.ai and Axelar. The investigation also identified an unnamed ransomware payment from September and funds associated with an October exploit involving gambling platform Gamdom. The researcher published wallet identifiers associated with the service, including its reported operational hot wallet and three addresses allegedly controlled by its administrator. According to the investigation, FreedomXMR obtained Monero liquidity through cryptocurrency exchange KuCoin.
Addresses linked to the operator reportedly made more than 3,000 deposits to the exchange. ZachXBT suggested that the service followed a conversion model resembling other cryptocurrency swapping operations, including Wagyu. Monero’s privacy features obscure transaction details, making subsequent fund movements more difficult to reconstruct using conventional public blockchain analysis. However, the reported deposits do not establish that KuCoin knowingly facilitated money laundering or that every Monero conversion involved criminal proceeds. The investigation also does not independently establish FreedomXMR’s complete lifetime transaction volume.
Hyperliquid’s Permissionless Listings Face Renewed Scrutiny
FreedomXMR reportedly obtained its FXMR ticker through a Hyperliquid auction on July 27, paying 518.28 HYPE, worth approximately $28,000 at the time. Hyperliquid’s HIP-1 token deployment framework uses a Dutch auction system that allows participants to acquire listing rights without approval from a centralized committee. The structure supports open market access but can also allow operators to establish services without conventional exchange-listing reviews. ZachXBT alleged that other centralized laundering operations, including b1exch, had previously used similar infrastructure. He said the supporting blockchain data had been shared with the Hyperliquid team.
As of October 20, no public enforcement action against FreedomXMR or formal response from Hyperliquid had been confirmed. The case illustrates a broader compliance challenge for decentralized financial infrastructure. Permissionless protocols can enable legitimate trading and financial innovation while making it difficult to prevent potentially abusive services from appearing. Nevertheless, deploying a token through Hyperliquid does not establish that the network’s developers control or endorse the associated operator. For investigators, the principal challenge is tracing stolen assets before conversion into privacy-preserving cryptocurrencies obscures subsequent transactions.
For trading platforms, the allegations may intensify scrutiny of transaction monitoring, suspicious wallet identification and cooperation with law enforcement. The reported $20 million remains an investigator-attributed estimate rather than a judicially established laundering total. Further disclosure of transaction records and responses from the parties involved will be necessary to independently assess the allegations.