Blockchain investigator ZachXBT says the large majority of inflows into FreedomXMR, a crypto exchange service operating on Hyperliquid Core, came from suspected illicit activity. According to his findings, more than 87% of incoming funds were linked to questionable sources, with over $20 million traced to cybercrime-related activity including hacks and ransomware payments.
The claims add fresh scrutiny to Hyperliquid’s permissionless listing model and to services that convert funds into Monero, a privacy-focused cryptocurrency that can make post-conversion tracking more difficult. At the same time, the reported transaction flows do not on their own establish that every participant in the chain knowingly handled criminal proceeds.
Wallets and deposits flagged in the investigation
ZachXBT identified 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 as the FXMR hot wallet and named three more addresses as administrator-controlled wallets. He also said he had identified more than 3,000 deposits into the exchange service from associated addresses.
The investigation further alleges that the service administrator sourced Monero liquidity through KuCoin. ZachXBT also suggested that FreedomXMR appears to use a swapping arrangement similar to Wagyu, another service he referenced in his reporting.
Why Monero is central to the allegations
Monero is designed to shield certain transaction details, which can complicate efforts to follow funds after they are converted. That feature has made the asset a recurring focus in investigations involving alleged laundering routes.
Still, the existence of an XMR transaction does not by itself prove criminal conduct. Likewise, the reported KuCoin transfers do not show that the exchange knowingly took part in any alleged laundering activity.
Questions around Hyperliquid’s listing system
FreedomXMR reportedly obtained the FXMR ticker through a Hyperliquid auction on July 27, paying 518.28 HYPE, worth about $28,000 at the time. Hyperliquid’s HIP-1 documentation says token deployment follows a Dutch auction model, meaning participants can obtain deployment rights without approval from a centralized listing committee.
Hyperliquid’s official notices also state that spot assets deployed by users are not endorsed by the development team. That structure has drawn attention as critics examine how permissionless systems handle projects or services later accused of facilitating illicit activity.
Comparison with earlier cases and what happens next
ZachXBT compared FreedomXMR with b1exch, another alleged centralized laundering service that he said had previously operated on Hyperliquid Core. He has raised similar concerns in other investigations into stolen crypto moving through multiple services, including an October report on the 2025 Bybit hack in which he described an alleged laundering network tied to more than $12 million in traced funds.
He said he shared a spreadsheet containing supporting blockchain data with the Hyperliquid team. As of the source report, he had not cited any enforcement action, account restrictions or formal response from the protocol, leaving the next confirmed development to any comment or action Hyperliquid may choose to make.
Source: crypto.news