ZachXBT Links $20 Million in Illicit Funds to Monero Swap Service

On October 20, famous blockchain investigator ZachXBT said more than $20 million linked to cyberattacks and illicit activity has flowed into FreedomXMR (FXMR), a Monero swap service on Hyperliquid Core. According to ZachXBT, these funds accounted for over 87% of the service’s total inflows since FreedomXMR emerged in August 2026.

The findings indicate that a new service operating for less than three months may have become a significant transfer point for funds from cyberattacks into a high-privacy asset. FreedomXMR was deployed through Hyperliquid’s permissionless mechanism, while the transaction data serving as the basis for ZachXBT’s assessment has not been made public.

The Incidents Behind ZachXBT’s $20 Million Estimate

In a Telegram post on October 20, ZachXBT stated that he manually reviewed inflows to FXMR worth over $10,000 and traced more than $20 million to ransomware, malware, social engineering attacks, and exploits. His list includes incidents involving DCENT Wallet, Fetch.ai, Axelar, and the gambling platform Gamdom, along with an undisclosed ransomware payment.

Both DCENT and Gamdom published separate security incident announcements in September and October, but neither notice mentioned FreedomXMR. The link between funds from these incidents and FXMR currently relies on ZachXBT’s tracing work. He has not disclosed the specific amount attributed to each incident.

The list also notes an Axelar incident in September 2026 but without an accompanying reference transaction. Meanwhile, public records from Secret Network record an exploit of the Axelar–Secret bridge on June 10. It remains undetermined whether this is the incident referenced by ZachXBT.

ZachXBT described the 87% figure in terms of inflow value, while the $20 million threshold was derived from individual inflows exceeding $10,000. The total value of assets that have passed through FreedomXMR and the specific contribution of each incident are currently not publicly available.

FreedomXMR’s Footprint on Hyperliquid

FreedomXMR reportedly began operating on Hyperliquid Core in August 2026. Prior to this, the deployer paid 518.28 HYPE to register the FXMR ticker in an auction on July 27, equivalent to approximately $28,000 at the time of the transaction.

FXMR was deployed under HIP-1, the native token standard supporting asset issuance and spot orderbook setup on Hyperliquid Core. Hyperliquid documentation states that deployment costs are determined via a 31-hour Dutch auction, where the price gradually decreases until a party accepts the current rate.

The permissionless process allows a deployer to launch a ticker and spot market without awaiting approval from a centralized entity. Therefore, FXMR’s operation on Hyperliquid Core does not imply that Hyperliquid vetted or endorsed FreedomXMR. ZachXBT’s allegations target the operator of the service, not Hyperliquid in its role as underlying deployment infrastructure.

KuCoin, Monero and the Liquidity Route

FreedomXMR’s XMR liquidity source is linked to KuCoin, where addresses tied to the administrator made over 3,000 deposits, according to ZachXBT’s analysis. In the described model, FreedomXMR receives assets from users on transparent blockchains, pays out in Monero, and replenishes the necessary XMR via a centralized exchange.

Currently, there are no public figures regarding the timeframe, total value, or number of KuCoin accounts involved in these 3,000+ deposits. The transfer of assets to KuCoin by addresses linked to FreedomXMR does not in itself indicate that the exchange was aware of the funds’ origins or participated in running the service.

After assets are swapped into Monero, the subsequent trail is no longer publicly visible as it is on Ethereum. According to Monero technical documentation, ring signatures mix the real signer with decoy outputs, stealth addresses generate one-time addresses for receivers, and RingCT hides transaction amounts.

Investigators can still trace assets to FreedomXMR’s deposit address, but they cannot directly match that input to the XMR paid out to the customer using public blockchain data alone. Continuing the money trail usually requires additional data from operators, exchanges, or associated devices. These privacy features apply to all Monero transactions and do not in themselves prove money laundering activity.

Key Evidence Remains Private

ZachXBT published one FXMR hot wallet and three addresses that he links to the FreedomXMR administrator. However, the data sheet shared privately with Hyperliquid has not been made public. Without the transaction list and detailed calculation methodology, independent parties cannot reconstruct the full flow of funds from each incident or verify the two figures of over $20 million and 87%.

As of publication, there are no court filings, regulatory findings, or law enforcement announcements identifying FreedomXMR as a money laundering service. Nor is there public evidence showing that platforms have restricted transactions with the cited addresses, that related KuCoin accounts have been frozen, or that FXMR has been delisted from trading interfaces. Hyperliquid, KuCoin, and the operator of FreedomXMR have not issued public statements regarding the allegations.

The post ZachXBT Links $20 Million in Illicit Funds to Monero Swap Service appeared first on NFT Evening.