ZachXBT Exposes Money Laundering Service FreedomXMR in Hyperliquid Ecosystem: 87% of Inflows Tied to Illicit Activity, Exceeding $20 Million

On October 20, 2026, according to the latest investigation report released by renowned on-chain detective ZachXBT, the centralized money laundering service FreedomXMR (FXMR) deployed within the Hyperliquid L1 network ecosystem has over 87% of its fund flows directly linked to serious illicit activities.

A deep investigation into historical fund flows exceeding $10,000 per transaction reveals that the more than $20 million in illicit funds accumulated by this service originated directly from ransomware attacks, malicious code injection, protocol vulnerability exploitation, and sophisticated targeted social engineering scams.

Tracing Money Laundering Pathways Through Four Major Security Incident Cases

Based on the on-chain fund flow evidence chain compiled by ZachXBT, the FXMR money laundering network is deeply implicated in several recent high-profile security breaches, including the theft of DCENT hardware wallets, cross-chain security incidents involving Fetch.ai and Axelar, and asset laundering on the gambling platform Gamdom.

To evade anti-money laundering scrutiny, the behind-the-scenes administrators of the service primarily utilized liquidity channels at the KuCoin exchange to batch acquire the privacy coin Monero (XMR), launching densely concentrated deposit records exceeding 3,000 transactions in a short period.

Estimates indicate that the average single-transaction laundering amount for these over 3,000 XMR deposits is merely $6,666, exhibiting a highly anti-forensic, small-amount high-frequency pattern designed to bypass exchange-triggered risk control alerts.

Leveraging 700x to Scale the Black and Gray Market Laundering Operation

According to on-chain auction records, FXMR operators participated in a token symbol auction on the Hyperliquid network in July, securing the identifier by paying only 518.28 HYPE tokens (approximately $28,000 in fiat value at the time).

Calculations reveal that using this permissionless infrastructure entry point costing just $28,000, the laundering syndicate subsequently leveraged and successfully laundered up to $20 million in illicit funds, achieving a non-compliant leverage multiplier of up to 714 times.

Working backward from the current 87% involvement ratio, the total capital accumulated by FXMR since its launch in August amounts to approximately $22.98 million, having almost completely devolved into an exclusive on-chain cleaning relay pipeline for hackers and ransomware gangs.

The Compliance Battle Over Permissionless Infrastructure

Besides FXMR, according to information from ZachXBT's official channel, multiple black and gray market laundering intermediaries, including b1exch, are also accused of abusing Hyperliquid's permissionless deployment mechanism, using the network as a springboard to evade compliance tracking.

While pursuing permissionless and censorship-resistant code at the base layer of public chains remains a core tenet of the decentralized narrative, when the application layer evolves into a sanctuary for illicit operations, core ecosystem developers will inevitably face scrutiny amid the global anti-money laundering regulatory storm.

Currently, ZachXBT has submitted a complete dossier of evidence, including full on-chain address labels, transaction hashes, and detailed fund information related to the case, to the official Hyperliquid team. Market participants are now awaiting the core development team's response and handling plan for such malicious laundering contracts.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps