On October 20, well-known blockchain investigator ZachXBT stated greater than $20 million linked to cyberattacks and illicit exercise has flowed into FreedomXMR (FXMR), a Monero swap service on Hyperliquid Core. In keeping with ZachXBT, these funds accounted for over 87% of the service’s whole inflows since FreedomXMR emerged in August 2026.
The findings point out {that a} new service working for lower than three months might have grow to be a big switch level for funds from cyberattacks right into a high-privacy asset. FreedomXMR was deployed by Hyperliquid’s permissionless mechanism, whereas the transaction information serving as the idea for ZachXBT’s evaluation has not been made public.
The Incidents Behind ZachXBT’s $20 Million Estimate
In a Telegram put up on October 20, ZachXBT said that he manually reviewed inflows to FXMR price over $10,000 and traced greater than $20 million to ransomware, malware, social engineering assaults, and exploits. His listing contains incidents involving DCENT Pockets, Fetch.ai, Axelar, and the playing platform Gamdom, together with an undisclosed ransomware fee.
Each DCENT and Gamdom printed separate safety incident bulletins in September and October, however neither discover talked about FreedomXMR. The hyperlink between funds from these incidents and FXMR at present depends on ZachXBT’s tracing work. He has not disclosed the particular quantity attributed to every incident.
The listing additionally notes an Axelar incident in September 2026 however with out an accompanying reference transaction. In the meantime, public data from Secret Community document an exploit of the Axelar–Secret bridge on June 10. It stays undetermined whether or not that is the incident referenced by ZachXBT.
ZachXBT described the 87% determine by way of influx worth, whereas the $20 million threshold was derived from particular person inflows exceeding $10,000. The whole worth of belongings which have handed by FreedomXMR and the particular contribution of every incident are at present not publicly out there.
Money circulate associated to FreedomXMR. Supply: ZachXBT
FreedomXMR’s Footprint on Hyperliquid
FreedomXMR reportedly started working on Hyperliquid Core in August 2026. Previous to this, the deployer paid 518.28 HYPE to register the FXMR ticker in an public sale on July 27, equal to roughly $28,000 on the time of the transaction.
FXMR was deployed beneath HIP-1, the native token commonplace supporting asset issuance and spot orderbook setup on Hyperliquid Core. Hyperliquid documentation states that deployment prices are decided through a 31-hour Dutch public sale, the place the value regularly decreases till a celebration accepts the present charge.
The permissionless course of permits a deployer to launch a ticker and spot market with out awaiting approval from a centralized entity. Subsequently, FXMR’s operation on Hyperliquid Core doesn’t suggest that Hyperliquid vetted or endorsed FreedomXMR. ZachXBT’s allegations goal the operator of the service, not Hyperliquid in its function as underlying deployment infrastructure.
KuCoin, Monero and the Liquidity Route
FreedomXMR’s XMR liquidity supply is linked to KuCoin, the place addresses tied to the administrator revamped 3,000 deposits, in accordance with ZachXBT’s evaluation. Within the described mannequin, FreedomXMR receives belongings from customers on clear blockchains, pays out in Monero, and replenishes the required XMR through a centralized change.
Presently, there are not any public figures concerning the timeframe, whole worth, or variety of KuCoin accounts concerned in these 3,000+ deposits. The switch of belongings to KuCoin by addresses linked to FreedomXMR doesn’t in itself point out that the change was conscious of the funds’ origins or participated in working the service.
After belongings are swapped into Monero, the next path is now not publicly seen as it’s on Ethereum. In keeping with Monero technical documentation, ring signatures combine the true signer with decoy outputs, stealth addresses generate one-time addresses for receivers, and RingCT hides transaction quantities.
Investigators can nonetheless hint belongings to FreedomXMR’s deposit handle, however they can’t instantly match that enter to the XMR paid out to the client utilizing public blockchain information alone. Persevering with the cash path often requires further information from operators, exchanges, or related units. These privateness options apply to all Monero transactions and don’t in themselves show cash laundering exercise.
Key Proof Stays Non-public
ZachXBT printed one FXMR sizzling pockets and three addresses that he hyperlinks to the FreedomXMR administrator. Nonetheless, the information sheet shared privately with Hyperliquid has not been made public. With out the transaction listing and detailed calculation methodology, impartial events can’t reconstruct the total circulate of funds from every incident or confirm the 2 figures of over $20 million and 87%.
As of publication, there are not any court docket filings, regulatory findings, or regulation enforcement bulletins figuring out FreedomXMR as a cash laundering service. Neither is there public proof displaying that platforms have restricted transactions with the cited addresses, that associated KuCoin accounts have been frozen, or that FXMR has been delisted from buying and selling interfaces. Hyperliquid, KuCoin, and the operator of FreedomXMR haven’t issued public statements concerning the allegations.
