ZachXBT Warns FreedomXMR on Hyperliquid Core Is Laundering Funds From Notable Exploits
Key Takeaways
- •ZachXBT's research links roughly $20 million from crypto exploit wallets to FreedomXMR, a laundering service built on Hyperliquid Core that launched in August.
- •More than 87% of FreedomXMR's inflows are tied to illicit activity, with sources including the D'Cent wallet exploit, the Fetch.ai exploit, Axelar-connected funds, ransomware, and the October Gamdom exploit.
- •FreedomXMR sources its Monero from KuCoin, and ZachXBT identified 3,000 transfers between the platform and the exchange while the service offers no-KYC, untraceable swaps.
- •ZachXBT shared tracked addresses with the Hyperliquid team for investigation, but the permissionless core protocol does not control individual hubs, and FreedomXMR bought the FXMR ticker at a July auction for roughly $28,000.
- •XMR has rallied about 69.5% over three months to trade just under $600 after a brief spike to $616, but its price gains cannot be directly attributed to FreedomXMR activity.
On-chain researcher ZachXBT has warned that FreedomXMR, a service built on Hyperliquid Core, is now being used to launder proceeds from notable crypto exploits. According to his recent research, roughly $20 million drawn from a range of exploit wallets has been routed through the platform to convert stolen funds into privacy coins.
FreedomXMR operates as a centralized laundering service and launched on Hyperliquid Core in August. ZachXBT noted that more than 87% of the platform's inflows are tied directly to illicit activity, a share that marks it as a dedicated laundering rail rather than a broadly used swapping venue.
On-chain transfers link FreedomXMR to several hacks, based on inflows above $10,000. The funds originate from ransomware, exploits, malware, and social engineering incidents. ZachXBT identified exploits including the D'Cent wallet exploit, a recent Fetch.ai exploit, funds connected to Axelar, additional ransomware payments, and the Gamdom exploit from October.
Most of the laundered funds stem from exploits carried out within the past two months. As Cryptopolitan previously reported, XMR has also been used to launder funds through centralized markets, contributing to rogue price rallies. FreedomXMR introduces a step of separation between exchanges, making the laundering less noticeable.
The FreedomXMR hot wallet is transparent and shows mostly smaller swaps into FXMR tokens. As of October, the hot wallet holds a little over $500,000, as exploit funds were moved out quickly. ZachXBT also revealed admin wallets with additional activity, including USDC transfers to other chains such as Arbitrum. The full set of tracked addresses has been shared with the Hyperliquid team for further investigation, and several are publicly viewable on Hypurrscan, including 0x5168...def2, 0x1b7f...bdb2, 0x06ec...0b19, and 0xecbb...9406. Since these wallets remain openly viewable, any new transactions touching them would appear on-chain as they occur, giving observers a public way to follow whether the flows continue.
FreedomXMR sources its XMR from KuCoin
Hackers typically rely on mixers, most of which operate within the Ethereum ecosystem. The Tornado Cash mixer remains in use, but it requires routing funds through Ethereum's network and bridges.
FreedomXMR instead offers direct swaps into Monero (XMR), a privacy coin that is difficult to trace. The platform sources its XMR from KuCoin, and its addresses have been linked to the exchange's wallets. According to ZachXBT, FreedomXMR uses an approach similar to Wagyu to offer no-KYC, untraceable transactions, and he identified a total of 3,000 transfers between FreedomXMR and KuCoin — a volume that documents how heavily the service draws on centralized exchange liquidity for its supply.
Reportedly, ZachXBT has notified Hyperliquid's team of the presence of laundering services. The allegations do not implicate all Hyperliquid users, but only specific funds on FreedomXMR that originate from illegal activity.
Hyperliquid Core remains permissionless, and FreedomXMR purchased the FXMR ticker at an open auction in July, paying 518.28 HYPE, or around $28,000. Hyperliquid Core does not control the activities of such services and allows multiple similar hubs, such as b1exch. These work as permissionless exchanges while sourcing trades from centralized markets, a design that leaves questions around policing individual hubs with the services themselves rather than the core protocol.
XMR rallies to a three-month peak
Interest in XMR has expanded over the past three months, lifting the privacy coin to a three-month peak. The technology itself remains untraceable and has pursued wider adoption despite its reputation as a money-laundering tool.
XMR traded just under $600 after a brief spike to $616, having added a net 69.5% over the past three months, with periodic spikes in trading activity, per CoinGecko data. The XMR gains cannot be traced directly to FreedomXMR activity. For now, XMR is outperforming BTC and following the rise of ZCash (ZEC), another high-profile privacy coin.
XMR remains limited for trading on most centralized markets under US or European regulations. Despite this, tools still exist to trade XMR and ZEC without KYC or revealing original addresses.
ZachXBT's recent research does not compromise Monero's privacy; it relies solely on the fully transparent Hyperliquid Core addresses and activity.
