ZachXBT: Over 87% of inflows to FreedomXMR, a money laundering service on HL Core, are tied to illicit activity

On October 20, on-chain detective ZachXBT stated that in August 2026, a centralized money laundering service called FreedomXMR (FXMR) appeared on Hyperliquid Core (HL Core). More than 87% of its inflows are directly tied to illicit activity. After manual verification, of all FXMR's historical inflows exceeding $10,000, more than $20 million originated directly from ransomware attacks, exploits, malware, and social engineering attacks, including:

• DCENT wallet exploit (September 2026)
• Fetch[.]ai exploit (September 2026)
• Axelar exploit (September 2026)
• A ransomware payment (September 2026, specific source undisclosed)
• Gamdom exploit (October 2026)

The service's operator sourced XMR liquidity from KuCoin (over 3,000 deposits), allegedly using an exchange model similar to Wagyu. The FXMR ticker was purchased by the operator for 518.28 HYPE (approximately $28,000) in an HL auction on July 27, 2026. Multiple such centralized money laundering services have previously appeared on HL Core, exploiting the chain's "permissionless" design characteristics and its widespread adoption to conduct illicit money laundering. The relevant data tables have been shared with the Hyperliquid team.