ZachXBT Links $20M in Illicit Flows to Hyperliquid Service

On Oct. 20, 2026, blockchain investigator ZachXBT linked more than $20 million in illicit funds to FreedomXMR, a Monero swap service operating on Hyperliquid Core. His report stated that more than 87% of the service’s inflow volume was tied to ransomware, exploits, malware and social-engineering attacks.

The estimate came from a manual review of every historical FreedomXMR inflow above $10,000. The transactions were linked to five incidents: the DCENT Wallet, Fetch.ai and Axelar exploits, an unnamed ransomware payment in September 2026, and the Gamdom exploit in October 2026.

FreedomXMR appeared on Hyperliquid Core in August 2026. The service accepted one cryptocurrency from users and returned Monero, a privacy-focused cryptocurrency that makes subsequent tracing more difficult. According to the report, the service’s administrator obtained Monero liquidity from KuCoin through more than 3,000 deposits.

The report does not accuse KuCoin of knowingly facilitating criminal activity or allege other wrongdoing by the exchange. It identifies KuCoin as a source of the Monero used by FreedomXMR.

ZachXBT identified the service’s main wallet as 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2. He also listed three other addresses controlled by the administrators and provided the underlying data to the Hyperliquid team.

The service obtained the FXMR ticker in a Hyperliquid auction on July 27, 2026, for 518.28 HYPE, worth about $28,000 at the time. HYPE traded at about $81.67 on Oct. 21, according to Binance market data, putting the same amount at roughly $42,300.

The report described FreedomXMR as a centralized laundering service using Hyperliquid’s permissionless design. It also identified b1exch as another centralized service that had used Hyperliquid Core in a similar way.

The findings are based on blockchain tracing and are not a court ruling. The $20 million estimate covers only deposits above $10,000. The 87% figure refers to the share of inflow volume linked to illicit activity. Neither figure establishes criminal liability for a specific person.

The report does not allege wrongdoing by Hyperliquid. The platform allows users to obtain and trade assets without approval from a central listing authority. ZachXBT provided the findings to the Hyperliquid team, which can potentially restrict or remove the service.

It was not immediately clear whether Hyperliquid had frozen the identified wallets or delisted FXMR. The report also did not establish whether exchanges connected to the addresses had filed suspicious activity reports or taken other action.