Crypto analyst ZachXBT said he uncovered FreedomXMR, or FXMR, a service he linked to money laundering within the Hyperliquid ecosystem. The service went live in August 2026, and ZachXBT said more than 87% of the funds flowing through it were obtained illegally.

After analyzing transfers of $10,000 or more, ZachXBT traced more than $20 million that he said came from hacks, ransomware attacks and fraud.

Funds linked to exploits and ransomware

ZachXBT said funds connected to several incidents passed through FreedomXMR. They included the D’CENT Wallet, Fetch.ai and Axelar exploits in September 2026, as well as an unnamed ransomware payment during the same month.

The analyst also linked funds from the Gamdom exploit in October 2026 to the service.

According to ZachXBT’s observations, the FreedomXMR administrator sources Monero liquidity from the KuCoin cryptocurrency exchange. The analyst recorded more than 3,000 deposits to KuCoin and suggested that FreedomXMR uses an exchange model similar to Wagyu.

FXMR ticker and Hyperliquid activity

The FXMR ticker was purchased at a Hyperliquid auction on July 27, 2026, for 518.28 HYPE. The amount was worth about $28,000 at the time.

ZachXBT said the Hyperliquid Core network has already faced abuse of its permissionless architecture by centralized services, including b1exch. In his view, those services are taking advantage of the network’s capabilities and growing popularity.

The analyst said he had shared a spreadsheet containing the underlying FreedomXMR transaction data with the Hyperliquid team.

ZachXBT previously infiltrated a Chinese syndicate and traced more than $1 billion in funds linked to Lazarus Group.

Source: Incrypted