On October 20, well-known blockchain investigator ZachXBT stated greater than $20 million linked to cyberattacks and illicit exercise has flowed into FreedomXMR (FXMR), a Monero swap service on Hyperliquid Core. Based on ZachXBT, these funds accounted for over 87% of the service’s complete inflows since FreedomXMR emerged in August 2026.
The findings point out {that a} new service working for lower than three months might have turn out to be a big switch level for funds from cyberattacks right into a high-privacy asset. FreedomXMR was deployed by way of Hyperliquid’s permissionless mechanism, whereas the transaction knowledge serving as the premise for ZachXBT’s evaluation has not been made public.
The Incidents Behind ZachXBT’s $20 Million Estimate
In a Telegram submit on October 20, ZachXBT acknowledged that he manually reviewed inflows to FXMR value over $10,000 and traced greater than $20 million to ransomware, malware, social engineering assaults, and exploits. His record contains incidents involving DCENT Pockets, Fetch.ai, Axelar, and the playing platform Gamdom, together with an undisclosed ransomware fee.
Each DCENT and Gamdom revealed separate safety incident bulletins in September and October, however neither discover talked about FreedomXMR. The hyperlink between funds from these incidents and FXMR at the moment depends on ZachXBT’s tracing work. He has not disclosed the precise quantity attributed to every incident.
The record additionally notes an Axelar incident in September 2026 however with out an accompanying reference transaction. In the meantime, public data from Secret Community document an exploit of the Axelar–Secret bridge on June 10. It stays undetermined whether or not that is the incident referenced by ZachXBT.
ZachXBT described the 87% determine when it comes to influx worth, whereas the $20 million threshold was derived from particular person inflows exceeding $10,000. The entire worth of belongings which have handed by way of FreedomXMR and the precise contribution of every incident are at the moment not publicly accessible.
Money circulation associated to FreedomXMR. Supply: ZachXBT
FreedomXMR’s Footprint on Hyperliquid
FreedomXMR reportedly started working on Hyperliquid Core in August 2026. Previous to this, the deployer paid 518.28 HYPE to register the FXMR ticker in an public sale on July 27, equal to roughly $28,000 on the time of the transaction.
FXMR was deployed underneath HIP-1, the native token commonplace supporting asset issuance and spot orderbook setup on Hyperliquid Core. Hyperliquid documentation states that deployment prices are decided by way of a 31-hour Dutch public sale, the place the value steadily decreases till a celebration accepts the present charge.
The permissionless course of permits a deployer to launch a ticker and spot market with out awaiting approval from a centralized entity. Due to this fact, FXMR’s operation on Hyperliquid Core doesn’t indicate that Hyperliquid vetted or endorsed FreedomXMR. ZachXBT’s allegations goal the operator of the service, not Hyperliquid in its function as underlying deployment infrastructure.
KuCoin, Monero and the Liquidity Route
FreedomXMR’s XMR liquidity supply is linked to KuCoin, the place addresses tied to the administrator revamped 3,000 deposits, based on ZachXBT’s evaluation. Within the described mannequin, FreedomXMR receives belongings from customers on clear blockchains, pays out in Monero, and replenishes the mandatory XMR by way of a centralized trade.
Presently, there are not any public figures relating to the timeframe, complete worth, or variety of KuCoin accounts concerned in these 3,000+ deposits. The switch of belongings to KuCoin by addresses linked to FreedomXMR doesn’t in itself point out that the trade was conscious of the funds’ origins or participated in working the service.
After belongings are swapped into Monero, the next path is not publicly seen as it’s on Ethereum. Based on Monero technical documentation, ring signatures combine the true signer with decoy outputs, stealth addresses generate one-time addresses for receivers, and RingCT hides transaction quantities.
Investigators can nonetheless hint belongings to FreedomXMR’s deposit deal with, however they can’t straight match that enter to the XMR paid out to the client utilizing public blockchain knowledge alone. Persevering with the cash path normally requires extra knowledge from operators, exchanges, or related units. These privateness options apply to all Monero transactions and don’t in themselves show cash laundering exercise.
Key Proof Stays Personal
ZachXBT revealed one FXMR scorching pockets and three addresses that he hyperlinks to the FreedomXMR administrator. Nonetheless, the information sheet shared privately with Hyperliquid has not been made public. With out the transaction record and detailed calculation methodology, impartial events can’t reconstruct the complete circulation of funds from every incident or confirm the 2 figures of over $20 million and 87%.
As of publication, there are not any courtroom filings, regulatory findings, or legislation enforcement bulletins figuring out FreedomXMR as a cash laundering service. Neither is there public proof displaying that platforms have restricted transactions with the cited addresses, that associated KuCoin accounts have been frozen, or that FXMR has been delisted from buying and selling interfaces. Hyperliquid, KuCoin, and the operator of FreedomXMR haven’t issued public statements relating to the allegations.
