On-chain investigator ZachXBT has published findings indicating that FreedomXMR, a swap service operating on Hyperliquid Core, derives more than 87% of its inflows from illicit activity, with tainted funds totaling more than $20 million.

FreedomXMR, which trades under the ticker FXMR, first surfaced in August 2026. Within roughly two months of launching, it had reportedly become a destination for proceeds from several high-profile hacks.

What the Investigation Found

ZachXBT, a pseudonymous on-chain investigator, released the report on October 20, 2026. Despite operating in a decentralized environment, he characterizes FXMR as a centralized laundering service.

The headline figure relates to overall inflow volume. According to ZachXBT, 87% of the funds moving into FXMR are tied to illicit sources.

The $20 million total stems from a narrower analysis. ZachXBT manually reviewed transactions exceeding $10,000 and traced more than $20 million to crimes including ransomware, exploits, malware distribution, and social engineering.

The report links the service to a series of specific incidents:

• September 2026: exploits connected to DCENT Wallet, Fetch.ai, and Axelar, as well as an unnamed ransomware payment.
• October 2026: the Gamdom exploit.

How the Service Operates

According to the report, FXMR runs on a swap model similar to Wagyu services: a user hands over one asset, and the operator hands back another.

The asset dispensed on the other side of the counter is Monero (XMR), a privacy-focused coin designed to obscure senders, recipients, and transaction amounts on its blockchain. Those features have made privacy coins a recurring focus of regulatory scrutiny and exchange delistings across.

Per ZachXBT, the FXMR admin sources Monero liquidity from KuCoin. The investigator counted more than 3,000 deposits tied to addresses associated with the service. The findings do not allege wrongdoing by KuCoin itself, but they indicate that a centralized exchange appears to sit somewhere within FXMR's supply chain for the privacy coin it distributes.

The operator acquired the FXMR ticker through a Hyperliquid ticker auction, paying 518.28 HYPE, worth approximately $28,000 at the time.

Why Hyperliquid Keeps Appearing

Hyperliquid Core is the base layer of the Hyperliquid ecosystem, where assets are listed and traded. Its design is permissionless, meaning anyone who wins a ticker auction can deploy an asset without a gatekeeper approving it first. That openness cuts both ways: it lets projects launch without waiting on approvals, but it also means no one vets who is behind an asset before it starts trading.

FXMR is not the first case of its kind. Hyperliquid Core has previously hosted other centralized laundering services that took advantage of the same permissionless structure.

ZachXBT has provided a source data spreadsheet containing his findings to the Hyperliquid team. What, if anything, the platform does with it is the next development to watch.

The report also fits into the investigator's broader body of work tracking cybercrime, including laundering networks linked to North Korea.