On-chain researcher ZachXBT warned that the FreedomXMR service, based on Hyperliquid Core, is now being used to launder funds from notable exploits. He discovered $20M from various exploit wallets using FreedomXMR to trade exploit funds into privacy coins.
Recent research by ZachXBT showed FreedomXMR served as a new laundering venue for exploit funds.
The FreedomXMR platform works as a centralized laundering service, which was launched on Hyperliquid core in August. ZachXBT noted that more than 87% of inflows to the platform are tied directly to illicit activity.
On-chain transfers link FreedomXMR to several hacks, based on inflows above $10K. The funds come from ransomware, exploits, malware, and social engineering incidents. ZachXBT noted the exploits included the DCent wallet, a recent Fetch.ai exploit, as well as funds from Axelar, additional ransomware payments, and the Gamdom exploit from October.
Most of the laundered funds come from exploits from the past two months. As Cryptopolitan reported earlier, XMR has been used to launder funds through centralized markets as well, leading to rogue price rallies. FreedomXMR allows one step of separation between exchanges, making the laundering less noticeable.
The FreedomXMR hot wallet is transparent, showing mostly smaller swaps for FXMR tokens. As of October, the hot wallet holds a little over $500K, as the exploit funds were moved out quickly.
ZachXBT also revealed admin wallets with additional activity and moving USDC funds to other chains like Arbitrum. The full addresses tracked have been shared with the Hyperliquid team for further investigation.
FreedomXMR sources XMR from KuCoin
The usual approach of hackers is to use mixers, most of which are in the Ethereum ecosystem. The Tornado Cash mixer is still used, but requires routing the funds through Ethereum’s network and bridges.
FreedomXMR offers direct swaps for Monero (XMR), a privacy coin that is difficult to trace. The platform sources its XMR from KuCoin, and its addresses have been linked to the exchange wallets. FreedomXMR uses an approach similar to Wagyu to offer no-KYC, untraceable transactions.
ZachXBT pointed out a total of 3,000 transfers between FreedomXMR and KuCoin. Reportedly, he notified Hyperliquid’s team of the presence of laundering services. The allegations do not point to all Hyperliquid users, but only to specific funds on FreedomXMR, originating from illegal activities.
Hyperliquid Core remains permissionless, and FreedomXMR bought the FXMR ticker at an open auction in July, paying 518.28 HYPE, or around $28,000. Hyperliquid Core does not control any of the activities of those services, and allows multiple similar hubs, such as b1exch. The services work as a permissionless exchange, which nevertheless sources trades from centralized markets.
XMR rallies to a three-month peak
Interest in XMR has expanded in the past three months, boosting the privacy coin to a three-month peak. The technology itself remains untraceable and has pursued wider adoption despite its reputation as a money-laundering tool.
XMR traded at just under $600, after a brief spike to $616. The coin added a net 69.5% in the past three months, with periodic spikes in trading activity.
The XMR gains cannot be traced directly to the FreedomXMR activity. For now, XMR outperforms BTC and follows the rise of ZCash (ZEC), another high-profile privacy coin.
XMR remains limited for trading on most centralized markets, based on US or European regulations. Despite this, there are still tools to trade XMR and ZEC with no KYC or revealing the original addresses.
Recent research by ZachXBT does not compromise Monero privacy; it relies solely on the fully transparent Hyperliquid Core addresses and activity.
The smartest crypto minds already read our newsletter. Want in? Join them.