ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid

What it is

FreedomXMR (FXMR) is a centralized Monero swap service on Hyperliquid Core (HL Core) that appeared in August 2026. ZachXBT, in a post on their Telegram channel, says more than 87% of its inflow volume came directly from illicit activity. Bankless reported it on the page. This note covers only what the existing summary leaves out.

How it works

ZachXBT reviewed every FXMR inflow above $10K by hand and traced over $20M to ransomware, exploits, malware and social engineering. The named sources are:

• the September 2026 DCENT Wallet, Fetch.ai and Axelar exploits
• an unnamed ransomware payment
• the October 2026 Gamdom exploit

The admin sources XMR liquidity from KuCoin, with 3K+ deposits to the exchange. ZachXBT says the service likely uses a swap model similar to Wagyu's. One flagged admin address won the FXMR ticker in Hyperliquid's permissionless auction on July 27, 2026, a few days before the service appeared. The page frames the roughly $31K cost as a cheap route onto a busy venue.

Preconditions / Affected

The abuse rests on HL Core's permissionless ticker auction and its adoption. ZachXBT names b1exch as another centralized laundering service that has abused the same design. Any team that screens or accepts funds touching HL Core swap services is exposed to this flow pattern.

What to do

The page gives no remediation steps. It reports two actions by ZachXBT: sharing a spreadsheet of source data with the Hyperliquid team, and freezing about $170K tied to the Bitget exploit at a different HL Core service earlier in October 2026. Engineers with screening or compliance duties could treat FXMR and b1exch addresses as high-risk, but the page does not publish addresses.

Caveats

The 87% and $20M figures come from ZachXBT's manual review, and the page does not describe the method beyond the $10K threshold. The Wagyu-style swap model is stated as likely, not confirmed. Hyperliquid had not publicly responded at publication. The page lists no wallet addresses or transaction hashes.