On-chain investigator ZachXBT has published findings on FreedomXMR, a swap service operating on Hyperliquid Core. He says over 87% of its inflows come from illicit activity, totaling more than $20 million.
FreedomXMR, which trades under the FXMR ticker, only surfaced in August 2026. Within roughly two months, it had apparently become a destination for proceeds from several high-profile hacks.
What ZachXBT found
ZachXBT released the report on October 20, 2026. He describes FXMR as a centralized laundering service, despite the decentralized setting it operates in.
The headline number comes from inflow volume. According to ZachXBT, 87% of the money moving into FXMR is tied to illicit sources.
The $20 million figure comes from a narrower analysis. ZachXBT manually reviewed transactions above $10,000 and traced more than $20 million to crimes including ransomware, exploits, malware distribution, and social engineering.
The report ties FXMR to a list of incidents:
September 2026: exploits connected to DCENT Wallet, Fetch.ai, and Axelar, plus an unnamed ransomware payment.
October 2026: the Gamdom exploit.
How the service works
FXMR runs on a swap model similar to Wagyu services, according to the report. You hand over one asset, and the operator hands back another.
The asset on the other side of the counter is Monero (XMR). Monero is a privacy-focused coin designed to obscure senders, recipients, and amounts on its blockchain.
Per ZachXBT, the FXMR admin sources Monero liquidity from KuCoin. He counted over 3,000 deposits tied to addresses associated with the service.
The findings do not allege wrongdoing by KuCoin itself. They do show that a centralized exchange appears to sit somewhere in FXMR’s supply chain for the privacy coin it hands out.
The operator acquired the FXMR ticker in a Hyperliquid auction for 518.28 HYPE, worth approximately $28,000 at the time.
Why Hyperliquid keeps showing up
Hyperliquid Core is the base layer of the Hyperliquid ecosystem, where assets are listed and traded. Its design is permissionless, meaning anyone who wins a ticker auction can deploy an asset without a gatekeeper approving them.
FXMR is not the first case of its kind. Hyperliquid Core has previously hosted other centralized laundering services that took advantage of the same design.
ZachXBT has provided a source data spreadsheet to the Hyperliquid team.
The report also fits into ZachXBT’s broader work tracking cybercrime, including laundering networks linked to North Korea.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.