Blockchain investigator ZachXBT has published findings linking more than $20 million in suspected illicit funds to FreedomXMR (FXMR), a centralized Monero swap service deployed on Hyperliquid Core in August 2026. According to the investigation, over 87% of FreedomXMR’s recorded inflows were tied to ransomware, software exploits, malware, and social engineering attacks.
The investigator manually reviewed historical inflows exceeding $10,000 per transaction and identified funds connected to the September exploits involving DCENT Wallet, Fetch.ai, and Axelar, an undisclosed ransomware payment, and the October Gamdom exploit. ZachXBT reported that the service’s operators sourced Monero liquidity through KuCoin, with more than 3,000 related deposits identified.
The FXMR ticker was acquired through a Hyperliquid Dutch auction on July 27, 2026, for 518.28 HYPE, costing roughly $28,000 to $31,000. Hyperliquid’s permissionless HIP-1 framework allows spot token deployment without conventional listing approvals, but the investigation underscores that open infrastructure does not establish the legitimacy of tokens or services built on it.
ZachXBT said he shared a spreadsheet containing supporting transaction data with the Hyperliquid team. He also referenced previous centralized services, including b1exch, that allegedly exploited the platform’s open design. In a separate case earlier in October, the investigator reported freezing approximately $170,000 associated with the Bitget exploit at a service operating on Hyperliquid Core.
The revelations could intensify regulatory scrutiny of privacy-focused services and permissionless trading platforms, while highlighting the role of on-chain transparency and independent investigations in the crypto ecosystem.
