On-chain investigator ZachXBT says he has traced more than $20 million from hacks, ransomware and other suspected criminal activity into FreedomXMR (FXMR), a centrally operated conversion service using Hyperliquid Core, and estimates that more than 87% of the service’s incoming volume is directly connected to illicit sources.
The findings, published October 20, 2026, link FXMR flows to incidents involving DCENT Wallet, Fetch.ai, Axelar and Gamdom, as well as an unidentified ransomware payment. They also raise questions about how a service characterized by the researcher as a laundering operation could secure a Hyperliquid ticker through a permissionless auction and route transactions toward a major centralized cryptocurrency exchange.
The percentages, incident labels and entity associations are ZachXBT’s investigative conclusions. They have not been independently reproduced from his full source spreadsheet, which he says was shared with the Hyperliquid team, and they do not establish criminal culpability on the part of Hyperliquid or KuCoin.
How Did ZachXBT Trace More Than $20 Million Into FXMR?
According to the October 20 investigation shared through ZachXBT’s official investigations channel, FreedomXMR became active on Hyperliquid Core in August, after the right to use the FXMR ticker was acquired the previous month.
ZachXBT says he manually reviewed the service’s historical incoming transactions above $10,000 and associated more than $20 million with addresses and transfer paths linked to cybercrime. His reported total includes activity following the September 2026 DCENT Wallet, Fetch.ai and Axelar incidents, an unidentified September ransomware payment and an October incident involving Gamdom.
These are multiple source incidents, not a single $20 million attack against Hyperliquid. FXMR is identified in the research as a subsequent destination or conversion point for funds connected to those events, rather than as the vulnerability that caused each original compromise.
The 87% figure describes the share of the service’s inflow volume that the analyst says he tied to illicit activity. The $20 million figure comes from his review of larger individual inflows. Because those measures have different descriptions and thresholds, it would be misleading to treat the $20 million as an additional pool on top of the 87% share or to infer a precise total inflow figure without the underlying accounting.
Blockchain attribution also has limits. Transfers can be observed, but associating a wallet with an exploiter may depend on evidence collected across different chains, security reports and transaction histories. Not every intermediary account can be identified from blockchain data alone.
What Does the Fund-Flow Diagram Show?
The diagram accompanying the investigation maps several apparently separate streams of funds toward a wallet ZachXBT identifies as the FreedomXMR hot wallet, 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2. The source side of the chart includes wallets labeled as exploit-related, ransomware-related and connected to other suspicious activity.
The routes depict assets moving through intermediate addresses and cross-chain infrastructure, including Circle’s Cross-Chain Transfer Protocol and Hyperliquid bridging paths, before reaching the alleged FXMR service. Some flows are represented as separate source wallets converging into a single operational destination.
That structure is significant because an address associated with a known hack does not need to transfer directly into a cash-out service for investigators to reconstruct a route. Intermediate transactions can create a longer trail, but the strength of the connection depends on whether every link is grounded in verifiable events and sound address attribution.
The image is an investigator’s analytical reconstruction, not an independent judicial finding. Bridge and transfer protocols appearing in a flow diagram do not themselves become perpetrators merely because suspected proceeds were routed through them. Their use also does not mean every transaction passing through the same infrastructure is illicit.
Such routing patterns have featured in other investigations. DaveFinances previously covered a Bitget attacker’s funds moving through multiple networks toward privacy-oriented infrastructure. That case is separate from FXMR, but it illustrates the need to distinguish a traceable deposit path from proof of the final recipient.
What Is KuCoin’s Reported Connection to FreedomXMR?
ZachXBT alleges that the FXMR administrator sourced liquidity in Monero, or XMR, through KuCoin and that addresses linked to the operation made more than 3,000 deposits to the exchange. Monero is designed to conceal key details of transfers on its own network, making on-chain tracing after conversion substantially different from tracing transparent Ethereum-compatible assets.
In a possible centrally operated swap model, a customer supplies one asset to an operator, which then provides another asset from its own liquidity arrangements. That is different from a user independently trading a pair on an open order book, and it introduces a counterparty that may have information about the customer’s request.
However, an exchange deposit count is not a count of distinct customers, successful Monero withdrawals or laundering convictions. The available report does not publicly establish what KuCoin knew about the depositors, whether particular deposits were flagged, or whether the exchange’s own accounts directly held the traced proceeds.
Neither a source-of-liquidity allegation nor the appearance of the KuCoin name on a chart is proof the exchange knowingly facilitated money laundering. An assessment would require verified exchange account records, any available compliance correspondence and the actual conversion or withdrawal transactions.
Other blockchain investigations show why the distinction matters. As previously reported in ZachXBT’s separate probe of a suspected $1 billion laundering network, identifying service relationships and proving the knowledge or intent of individual participants are different investigative tasks.
How Did FXMR Obtain a Hyperliquid Trading Ticker?
The researcher identifies a July 27, 2026 transaction in which the right to deploy the FXMR ticker was acquired for 518.28 HYPE, valued at approximately $28,000 at the time. The referenced Hyperliquid transaction is a discrete on-chain record, separate from the later assertions about who operated the service and the sources of its deposits.
Hyperliquid’s HIP-1 spot-token system permits participation in a Dutch auction for token deployment rights. That design allows eligible participants to secure a ticker without a traditional centralized listing committee selecting every project.
Acquiring a ticker is not the same as a regulated money-transmission licence, compliance approval or a certification of the operator’s business model. Nor does it establish that validators, developers or ordinary Hyperliquid traders knew the nature of funds later associated with the listed project.
ZachXBT says other centrally operated conversion services, including b1exch, have used Hyperliquid Core. His assertion points to a possible recurring governance and monitoring problem, but cannot by itself establish how prevalent such operations are across the network.
Permissionless infrastructure creates a familiar trade-off: the absence of discretionary listing approval can broaden access for legitimate builders, while allowing suspicious businesses to acquire public-facing identifiers and liquidity routes. The question is which defenses can identify harmful use without assuming every deployment is suspect.
What Are the Risks for Hyperliquid and Crypto Investors?
The immediate issue is compliance and reputational exposure, rather than a confirmed compromise of Hyperliquid’s core protocol. The investigation does not claim the chain’s consensus was hacked, that all assets traded on Hyperliquid were tainted or that users of the FXMR ticker necessarily committed crimes.
Nevertheless, the reported ability of suspected exploit proceeds to pass through a recognizable service could draw attention from blockchain-security teams, exchanges and authorities seeking to follow stolen assets. ZachXBT says he provided supporting transaction data to the Hyperliquid team. No public finding from that review was established in the material available for this article.
For affected exploit victims, the critical practical question is whether funds remain on transparent networks or accessible accounts where recovery action might be possible, and whether investigators can obtain records before assets move into less transparent forms. A trace into an exchange is not equivalent to recovery, especially when the relevant account ownership and withdrawal history remain undisclosed.
That tension has appeared in efforts to block funds tied to illicit activity. DaveFinances previously examined a Tether, TRON and TRM Labs initiative to freeze hundreds of millions in suspected criminal proceeds. Such interventions can help disrupt transfers, but they do not guarantee that funds already converted or moved onward can be returned.
Investors assessing Hyperliquid should therefore separate the alleged conduct of an individual service from the security of the trading system and the token’s price. The findings might influence scrutiny of listings and compliance controls, but no specific financial impact on Hyperliquid or KuCoin has been independently quantified.
What Evidence Could Confirm the Allegations?
Further verification would require the complete transaction-by-transaction spreadsheet, the methodology for identifying illicit sources, the denominator used to calculate the 87% figure and a clear reconciliation of any assets transferred through bridge or exchange infrastructure. An operator response and relevant exchange-account evidence could also help clarify the alleged conversion business.
The publicly identified FXMR wallet and administrator-linked addresses give investigators concrete starting points. But address lists and transaction charts should be read as leads to examine, not proof that every connected person or platform knowingly participated in an offense.
For now, the documented development is ZachXBT’s October 20 allegation that a centrally operated service on Hyperliquid received more than $20 million traced to major cybercrime incidents and that an estimated 87% of its incoming volume had illicit origins. The unresolved issue is how that flow was converted, what the participating intermediaries knew and whether the evidence will prompt a formal response.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574