ZachXBT says Hyperliquid swap service FreedomXMR laundered over $20m in hacks and ransomware

Blockchain investigator ZachXBT has alleged that FreedomXMR, a swap service on Hyperliquid Core, received more than $20 million tied to ransomware, exploits and malware, with over 87% of its inflows linked to illicit activity. The service’s ticker cost just $28,000 to acquire.

In a report shared through his Telegram investigation channel, ZachXBT said a manual examination of historical transactions exceeding $10,000 connected the service to funds originating from several unrelated cybercrime incidents. He also stated that the findings had been forwarded to the Hyperliquid team for review.

The allegations focus on FreedomXMR and its operators, rather than establishing wrongdoing by Hyperliquid or other exchanges mentioned in the investigation. The case nevertheless highlights the challenges facing decentralized financial infrastructure when investigators identify suspicious activity but cannot automatically compel a platform to intervene.

How FreedomXMR allegedly moved funds through Monero

According to ZachXBT, FreedomXMR appeared on Hyperliquid Core in August 2026. The service allows users to deposit one cryptocurrency and receive another, with Monero (XMR) serving as the principal destination asset identified in the report.

Monero is a privacy-focused cryptocurrency designed to make transaction tracing more difficult than it is on transparent blockchains. By converting deposited assets into Monero, a service can complicate efforts to follow the movement of funds after they leave the original blockchain environment.

The investigation describes FreedomXMR’s operating model as similar to that of another swap service, Wagyu. Under this arrangement, customers send one asset to the operator, who provides a different cryptocurrency in return. The conversion process can create a gap between the publicly traceable deposit and the subsequent movement of the funds.

ZachXBT also identified KuCoin as a source of Monero liquidity for the service. The report states that the administrator sourced XMR through more than 3,000 deposits to the exchange.

However, the presence of KuCoin in the reported transaction trail does not establish that the exchange knowingly supported or facilitated illicit activity. The investigation identifies it as part of the alleged liquidity-sourcing process but does not accuse the exchange of criminal conduct.

The findings instead raise questions about how cryptocurrency exchanges assess transaction patterns involving services that may receive funds from multiple high-risk sources.

FreedomXMR’s reported reliance on Monero also illustrates the difficulties investigators face when assets move between transparent blockchain networks and privacy-oriented cryptocurrencies. Although transaction records on Hyperliquid can provide evidence of incoming transfers, following funds beyond that point may become substantially more difficult.

Five cybercrime incidents linked to FreedomXMR

The more than $20 million figure cited in the investigation comes from several individual incidents rather than a single large-scale attack. ZachXBT said his review of historical FreedomXMR inflows above $10,000 identified connections to five reported sources of illicit funds.

These included the DCENT Wallet exploit in September 2026, the Fetch.ai exploit in September, the Axelar exploit in September, an unnamed ransomware payment during the same month, and the Gamdom exploit in October 2026.

The alleged connections suggest that funds associated with different incidents may have converged on the same service. Investigators consider this type of pattern important because repeated inflows from unrelated attacks can help identify potential channels for moving or converting criminal proceeds.

ZachXBT summarized the scope of his review by stating that a “manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents.”

The finding provides a transaction-based account of the investigator’s allegations, although it does not independently establish criminal liability for every person or entity associated with the transactions.

The report also identifies the FreedomXMR hot wallet as: 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2

Three additional administrator-controlled addresses were reportedly included in the investigation. Such wallet identifiers can help cryptocurrency platforms assess exposure, monitor related transactions and determine whether restrictions or further investigations are warranted.

For exchanges and blockchain infrastructure providers, identifying addresses associated with suspicious activity is often an initial step in assessing financial crime risks. Any subsequent action, however, depends on the platform’s technical capabilities, applicable policies and legal obligations.

FreedomXMR’s $28,000 entry cost raises questions

One of the investigation’s most notable details concerns the cost of obtaining the FXMR ticker on Hyperliquid. According to ZachXBT, the ticker was acquired through a Hyperliquid auction on July 27, 2026, for 518.28 HYPE, valued at approximately $28,000 at the time.

The relatively modest entry cost, compared with the volume of allegedly illicit funds subsequently traced to the service, illustrates a potential weakness in permissionless listing systems. A participant may be able to establish a recognizable on-chain presence without undergoing the same onboarding procedures required by many centralized financial institutions.

Based on the reported figures, the more than $20 million in traced inflows is approximately 700 times the ticker’s original purchase price. That comparison highlights the scale of the activity identified by the investigation, although it does not represent the operator’s profit, revenue or total funds under management.

ZachXBT also pointed to previous cases involving services that allegedly exploited Hyperliquid Core’s open infrastructure. Referring to an earlier example, he wrote: “HL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption.”

The comment places the FreedomXMR allegations within a broader debate about the balance between open access and financial crime prevention in decentralized markets.

Hyperliquid’s permissionless architecture can make it easier for projects and users to access blockchain-based financial services. However, the same openness can create difficulties when a service is subsequently linked to suspicious transactions.

The investigation also arrives amid wider scrutiny of Hyperliquid, including reported congressional interest in potential insider trading. These issues concern different aspects of platform oversight, and the FreedomXMR allegations do not establish that the platform itself participated in laundering.

What the FreedomXMR investigation establishes and what comes next

ZachXBT’s findings constitute an on-chain investigation, not a court judgment. The more than $20 million figure covers transactions above the $10,000 threshold examined in the report. It therefore does not represent a verified total of every transaction processed by FreedomXMR throughout its operation.

Similarly, the claim that more than 87% of inflow volume was connected to illicit activity describes the investigator’s assessment of incoming funds. It should not be interpreted as a judicial finding or proof that every transaction, customer or administrator associated with the service was involved in a crime.

The distinction matters because blockchain investigations can identify transaction relationships and patterns without necessarily establishing the identities, intentions or legal responsibility of everyone involved.

The report does not accuse Hyperliquid of knowingly facilitating the alleged activity, nor does it establish wrongdoing by KuCoin. Instead, it identifies FreedomXMR and its associated wallets as the central subjects of the investigation and provides information that relevant platforms can assess.

The next steps will depend on how Hyperliquid and other affected entities respond. Possible measures could include reviewing the identified addresses, assessing exposure, restricting activity where technically and legally appropriate, or referring relevant findings to authorities. However, the report does not confirm that any wallet has been frozen or that FXMR has been delisted.

The case also raises a broader question for decentralized finance: how can permissionless platforms address suspected money laundering without undermining the open-access principles on which they operate?

Traditional financial institutions commonly rely on customer identification, transaction monitoring and suspicious-activity reporting. Applying comparable controls to decentralized systems is more complicated because blockchain transactions can occur without a central custodian or conventional account provider.

In this environment, independent investigators can play an important role by identifying suspicious transaction patterns and providing evidence to platforms capable of responding. Their findings, however, are not a substitute for formal investigations or legal determinations.

Monero adds another layer of complexity. Its privacy features can make it harder to trace funds after conversion, increasing the importance of identifying suspicious activity before assets leave a transparent blockchain.

For FreedomXMR, the central issue is whether the evidence presented by ZachXBT leads to concrete action against the service or its associated wallets. The report documents more than $20 million in allegedly illicit inflows, identifies five reported source incidents and describes how the service obtained access to Hyperliquid Core.

What remains unresolved is whether the findings will result in restrictions, a delisting or formal enforcement proceedings. Until those outcomes are confirmed, the investigation stands as a warning about the risks that can emerge when permissionless cryptocurrency markets intersect with services suspected of handling criminal proceeds.