ZachXBT investigation links 87% of FreedomXMR inflows on Hyperliquid to $20M in illicit funds
Blockchain investigator ZachXBT found over 87% of funds entering FreedomXMR on Hyperliquid Core came from ransomware, exploits, and social engineering attacks totaling more than $20 million.
Why it matters
The findings expose a centralized laundering rail operating on a major permissionless trading venue and place a licensed exchange in the liquidity supply chain, which could draw regulatory scrutiny toward both Hyperliquid Core's design and the compliance controls of upstream liquidity providers.
Key facts
ZachXBT published an investigation on October 20, 2026 linking over 87% of FreedomXMR inflows to illicit activity
Reported by Crypto.News
FreedomXMR (FXMR) is a Monero swap service that appeared on Hyperliquid Core in August 2026
Reported by Crypto.News
More than 87% of FreedomXMR inflows were linked to illicit activity
87 %Reported by Crypto.News
Illicit funds originated from five specific incidents: DCENT Wallet, Fetch.ai, and Axelar exploits in September 2026, an unnamed September ransomware payment, and the October 2026 Gamdom exploit
Reported by Crypto.News
The FreedomXMR administrator sourced Monero liquidity from KuCoin through more than 3,000 deposits
3,000 depositsReported by Crypto.News
The FXMR ticker was acquired in a Hyperliquid permissionless auction on July 27 for 518.28 HYPE, approximately $31,000 at the time
518.28 HYPEReported by Crypto.News
ZachXBT identified the FXMR hot wallet at 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 and three additional administrator-controlled addresses
Reported by Crypto News (CryptoNews.net)
What happened
Blockchain investigator ZachXBT published an investigation on October 20 showing that FreedomXMR, a Monero swap service operating on Hyperliquid Core since August 2026, received more than 87% of its inflow volume from illicit sources. A manual review of every transaction above $10,000 traced over $20 million to five specific incidents: the September 2026 exploits of DCENT Wallet, Fetch.ai, and Axelar, an unnamed September ransomware payment, and the October 2026 Gamdom exploit. The service's administrator sourced Monero liquidity from KuCoin through more than 3,000 deposits, though the report does not allege KuCoin knowingly facilitated the activity. ZachXBT identified the FXMR hot wallet and three additional administrator addresses, and noted that other centralized laundering services such as b1exch have also abused Hyperliquid Core's permissionless design. He shared a spreadsheet of source data with the Hyperliquid team.
How the story developed
- Update
Gamdom exploit
Online gambling platform exploited in October 2026
- First report
First report by Crypto.News
ZachXBT links over 87% of FreedomXMR inflows on Hyperliquid to illicit funds
- Update
FXMR ticker acquired in Hyperliquid auction
Administrator won FXMR ticker for 518.28 HYPE (~$31K)
- Update
FreedomXMR launches on Hyperliquid Core
Monero swap service appears on platform
- Update
September 2026 exploit incidents
DCENT Wallet, Fetch.ai, Axelar exploits and unnamed ransomware payment
- Update
ZachXBT publishes investigation
Onchain investigator releases findings linking 87% of FXMR inflows to $20M+ in illicit funds
- Independent corroboration
Independently corroborated by Bankless
ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid
- Update
Bankless publishes independent report
Confirms ZachXBT findings and adds context on XMR price movement and other laundering services
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 20 Oct 2026, 12:55 UTC: Crypto.News — 1 independent source, 1 reports
- 20 Oct 2026, 16:10 UTC: Crypto News (CryptoNews.net) — 2 independent sources, 2 reports
- 20 Oct 2026, 16:18 UTC: Bankless — 3 independent sources, 3 reports
Affected entities
Also mentioned: Binance, Bybit
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Crypto.News Crypto media | ZachXBT links over 87% of FreedomXMR inflows on Hyperliquid to illicit funds | Original | |
| Bankless Crypto media | ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid | Independent | |
| Crypto News (CryptoNews.net) Aggregator | Investigation Reveals Over 87% of FreedomXMR Transactions | Syndicated | |
| Crypto News (CryptoNews.net) Aggregator | ZachXBT Traces Over $20M in Illicit Flows Through FreedomXMR on Hyperliquid | Syndicated |
Related events
KuCoin Announces Multiple Service Updates Including API Symbol Changes, New Listings, and Trading Schedule in September 2026
KuCoin rolled out a series of service updates in September 2026 including ticker symbol changes, new token listings, trading pair launches, maintenance closures, and a VIP migration program.
KuCoin Suspends Blast Deposits Citing Maintenance, Gives No Restoration Date
KuCoin suspended Blast (BLAST) deposits for maintenance and said users will get no separate notice when the service returns, with no restoration date given.
NEAR Intents Says Exploiter Returned Full $3.8M After 48-Hour Ultimatum
NEAR Intents recovered the roughly $3.8 million taken in an Oct. 1 exploit of its Omni deposit infrastructure and closed its investigation, after naming the attacker and setting a 48-hour deadline.
KuCoin Launches Copy Rush Copy Trading Campaign With BTC, iPhone and Trial Fund Rewards
KuCoin started a Copy Trading task campaign running to October 18, 2026, where eligible users earn lucky draw chances for prizes including 0.002 BTC and an iPhone 18 Pro Max.
KuCoin Earn starts Week 135 of Friday yield offers on USDT, BTC and DOT
Bitcoin Insider reported that KuCoin Earn's Week 135 event opened at 08:00 UTC on October 2, 2026, with products advertised at up to 9% APR and extra rewards tied to KCS holdings.
Bitcoin Insider reports KuCoin CENT listing with 17,241,380 CENT giveaway
Bitcoin Insider reported that KuCoin listed Incentiv (CENT) on October 12, 2026 and ran a 17,241,380 CENT giveaway for traders.