Security

$20M Illicit Funds Flow Through FreedomXMR Laundering Service on Hyperliquid

2026-10-23

Blockchain investigator ZachXBT has linked more than 87% of inflows into FreedomXMR, a cryptocurrency exchange service operating on Hyperliquid Core, to suspected illicit activity, with over $20 million traced to cybercrime-related sources.

The service accepted one cryptocurrency from users and returned Monero, a privacy-focused cryptocurrency that makes subsequent tracing more difficult. It's a neat scheme: deposit whatever you want, get Monero back, vanish into the noise.

The investigator traced over $20 million to ransomware, exploits, malware and social engineering attacks. The identified incidents include attacks involving DCENT Wallet, Fetch.ai, Axelar and Gamdom.

The mechanics are bare-bones. ZachXBT linked the service's Monero liquidity to KuCoin and identified more than 3,000 exchange deposits. The administrator bought the FXMR ticker on Hyperliquid itself. That's it—no gatekeeper review, no AML checks, just a permissionless Dutch auction.

What makes this credible is the tracing. The estimate came from a manual review of every historical FreedomXMR inflow above $10,000. ZachXBT didn't just flag a percentage; he went through the books and linked specific thefts to specific deposits. DCENT, Fetch.ai, Axelar, Gamdom—all real breaches. The money moved on-chain in minutes and funnelled into Monero.

The report does not accuse KuCoin of knowingly facilitating criminal activity or allege other wrongdoing by the exchange. It identifies KuCoin as a source of the Monero used by FreedomXMR. KuCoin is simply the liquidity tap. The abuse sits squarely with the FXMR admins.

Hyperliquid's founding idea was permissionless—no gatekeepers, no committee veto, anyone can list a token. A chain built with no gatekeeper lets a service win a ticker and begin swapping deposited funds for Monero within hours, while the anti-money-laundering obligations that bind licensed venues have no obvious place to attach. That's elegant until you realise it creates a direct laundromat open to anyone with $28K and a Monero source.

Several centralized money laundering services, including b1exch, have been accused of exploiting the permissionless nature of the network, and related data has been submitted to the Hyperliquid team. This isn't an isolated incident. FreedomXMR is one of several similar services already abusing the protocol's design.

The investigation doesn't pin down the exact vector—how the FXMR admins vet depositors, whether they do any checks, who their downstream contacts are. The allegation is directed at the operators of FreedomXMR, not at Hyperliquid, and ZachXBT says he has passed his source data to the Hyperliquid team. That's the investigator being precise: Hyperliquid built the venue; FreedomXMR ran the operation.

Permissionless doesn't mean consequence-free. This will test whether regulators view Hyperliquid as infrastructure or as a venue. And it will test whether permissionless tokens can stay permissionless once they become this visible.

Source & further reading:

Sources