ZachXBT: $20M From Hacks Ran Through FreedomXMR, a Monero Swap on Hyperliquid
ZachXBT says over 87% of the money flowing into FreedomXMR, a Monero swap on Hyperliquid, was tied to crime, with $20M+ traced to hacks and ransomware.
Key numbers
$20M+
Illicit inflows
87%+
Inflow tied to crime
3,000+
KuCoin deposits
518.28 HYPE
Ticker bought for
On 20 October 2026 the blockchain investigator ZachXBT posted a short report to his Telegram channel about a service few people had heard of. FreedomXMR, he wrote, was "a new centralized laundering service". It had been open for less than three months. It took in ordinary cryptocurrency and paid out Monero, a coin built so that nobody can see who paid whom. And it did its business on Hyperliquid, one of the busiest crypto trading platforms in the world.
His numbers were stark. More than 87% of the money flowing into FreedomXMR, he wrote, was "tied directly to illicit activity". Checking by hand every payment in above $10,000, he traced more than $20 million to ransomware, hacks, malware and social engineering, the craft of tricking people rather than breaking computers. Among the sources he named were thefts from D'CENT, a South Korean wallet maker, from a bridge used by the AI token project Fetch.ai, and from the crypto casino Gamdom.
ZachXBT is a pseudonymous investigator who follows stolen crypto across public ledgers and is funded by donations. His findings are his own analysis, not a court ruling. Nobody has been charged, and the people behind FreedomXMR have not been named. He did not accuse Hyperliquid of running the service, or KuCoin, the exchange he says supplied its Monero, of any wrongdoing.
How a Monero swap works
Most cryptocurrencies are not anonymous. Bitcoin and ether sit on public ledgers that anyone can read, so a payment can be followed from wallet to wallet like a bank statement left open on a table. That is why stolen crypto is so often traced, and sometimes frozen. Monero, launched in 2014, is different. Its ledger records that a payment happened but hides the sender, the receiver and the amount. Following money into Monero is like following cash into a casino and losing sight of it at the cashier's window. Binance, the world's largest crypto exchange, stopped trading it in February 2024.
A swap service is a bureau de change for crypto: hand over one currency, get another back. FreedomXMR is centralised, meaning one operator holds the money and decides what to pay out, rather than self-running code. ZachXBT says it probably works like Wagyu, an older service that sells a Monero stand-in token on Hyperliquid and exchanges it for the real coin. Hyperliquid's public data fits that picture. FreedomXMR's token, FXMR, trades against USDC, a digital dollar, and on every trading day has changed hands at about a tenth of the price of one Monero coin. On 21 October the service's hot wallet, the internet-connected account a business uses like a till, held about 9,536 of them.
Hyperliquid runs on its own blockchain. Its core, HyperCore, works like a stock exchange's matching engine, pairing buy and sell orders. Unlike a stock exchange, it has no listing committee. Under its rules, known as HIP-1, anyone can create a token by winning a 31-hour auction for a ticker, the short trading code such as FXMR. The price falls until someone pays it, towards a floor of 500 HYPE, Hyperliquid's own coin. Hyperliquid's records show the FXMR ticker was bought at 11:10 UTC on 27 July 2026 for 518.28 HYPE, about $28,000, by an address ZachXBT lists as one of FreedomXMR's administrators. Trading began four days later.
Where the money came from
ZachXBT named five sources, all from September and October 2026.
D'CENT: from 15 September, thieves emptied 6,678 accounts in D'CENT's phone wallet app, taking about 11.75 million XRP, roughly $16 million, through a flaw the company links to old versions of the app.
Fetch.ai: on 19 September an attacker used a leaked signing key, the digital version of a bank manager's signature, to empty a bridge run by SingularityNET, the AI company led by Ben Goertzel, of 8.72 million FET, the token SingularityNET and Fetch.ai share. A bridge moves tokens between two blockchains, like a currency exchange booth. The attacker then printed billions of unbacked tokens and turned about $2.29 million into spendable money. On 22 September the tracing firm AMLBot reported that one slice, about $266,000 in USDC, had gone through Arbitrum, a cheaper network that runs alongside Ethereum, into Hyperliquid and been converted into "FXMR", which it took to be a Monero variant. That public warning came four weeks before ZachXBT's report.
Gamdom: on 13 October hackers drained the hot wallets of Gamdom, an online casino that takes bets in crypto. Its founder, Felix Roemer, put the loss at "just over $3m". An independent on-chain investigator who goes by vxdb counted about $4.2 million. Some of it was moved to Hyperliquid.
Axelar: ZachXBT gave no details. Axelar is a network that carries tokens between blockchains. The only Axelar-linked theft widely reported this year came in June, when the link between Axelar and Secret Network was drained of $4.67 million, and it is not clear whether that is the case he means.
The fifth was a ransomware payment in September. Ransomware is malicious software that locks a company's computers until it pays. The victim was not named.
ZachXBT did not say how much of each theft passed through FreedomXMR. His $20 million counts only payments above $10,000 that he could tie to a known crime.
Thieves have taken this road before. On 4 March 2026, robbers who forced a man known online as Sillytuna to hand over his keys at his home in Britain sent about $2.5 million to Hyperliquid and bought Monero there.
Why KuCoin's Monero matters
A bureau de change that promises euros needs a stock of euros. Markets call this liquidity: how easily something can be bought or sold in size without moving the price. FreedomXMR's customers wanted Monero, and Monero is hard to buy in bulk. According to ZachXBT, the operation sourced its Monero from KuCoin, an exchange run by a Seychelles company, and its addresses made more than 3,000 deposits there.
KuCoin matters because it is one of the few big exchanges still listing the coin. On 21 October it handled about half of all Monero trading on the exchanges tracked by CoinGecko, a price-tracking site: about $127 million out of roughly $249 million in 24 hours. A guide on KuCoin's own website this year ran under the headline "Why KuCoin Remains the Top Choice for Buying XMR?"
The report does not accuse KuCoin of wrongdoing, and once Monero leaves an exchange, the exchange cannot see where it goes. KuCoin does have a history with American prosecutors. In January 2025 its operator, Peken Global, pleaded guilty in a federal court in New York to running an unlicensed money transmitting business and agreed to pay more than $297 million, after the US Department of Justice said it had failed to keep proper anti-money-laundering and customer identity checks. KuCoin had not commented on ZachXBT's findings by 21 October.
What is not known
Almost nothing is public about the people behind FreedomXMR. ZachXBT published four addresses, a hot wallet and three he calls admin wallets, but no names, and nobody has claimed the service. No law enforcement agency has announced an investigation.
Hyperliquid is not accused of running FreedomXMR. ZachXBT wrote that other centralised laundering services, including one called b1exch, have abused the platform's "permissionless design and adoption", and that he had shared a spreadsheet of source data with the Hyperliquid team. Hyperliquid had not responded publicly by 21 October, and it is not clear what, if anything, it can or will do. There is a link worth knowing: in January 2026 the Hyperliquid Foundation donated 10,000 HYPE, then worth about $254,000, to ZachXBT. Services on Hyperliquid do sometimes act. On 5 October he said he had frozen about $170,000 from the Bitget theft "at a service on HL Core".
The FXMR market has gone quiet. Hyperliquid's public data shows the last trade at 13:46 UTC on 19 October, the day before the report, and on the afternoon of 21 October nobody was offering FXMR for sale. Since trading began on 31 July, about $23 million of it had changed hands in roughly 1,850 trades, by a CMZ tally of that data. The busiest week was 10 to 16 August, with about $10.5 million, a month before the first theft ZachXBT named. He has not said what drove it.
Whatever left as Monero cannot be followed on any public ledger.
The aftermath
As of 21 October 2026, nobody has been charged and the operators of FreedomXMR have not been named. ZachXBT's figures, more than $20 million traced to crime and more than 87% of inflow volume tied to illicit activity, are his own analysis of public blockchain data. No court or government agency has tested or confirmed them, and no law enforcement action has been announced.
ZachXBT shared his source data with Hyperliquid, which had not commented publicly. KuCoin, named as the source of the service's Monero, had not commented either and is not accused of wrongdoing. FreedomXMR's operators have said nothing.
According to Hyperliquid's public market data, no FXMR has traded since 13:46 UTC on 19 October, and on 21 October nobody was offering any for sale. The hot wallet ZachXBT identified still held about 9,536 FXMR, worth about $575,000 at the last traded price. Whether the service has closed, paused or simply moved elsewhere is not known.
None of the victims ZachXBT named has recovered money from this route. D'CENT's app users, the SingularityNET bridge and Gamdom all lost funds that, once turned into Monero, cannot be followed on a public ledger. The trail that remains runs the other way: the more than 3,000 deposits ZachXBT says the operation made at KuCoin.
What this teaches
- Permissionless listing cuts both ways. Anyone can open a market on a busy platform without a committee's approval, and FreedomXMR's operators did it for about $28,000.
- Laundering still needs a supplier. With large exchanges such as Binance no longer trading Monero, services that hand it out depend on the few venues that still list it; ZachXBT traced FreedomXMR's supply to more than 3,000 deposits at KuCoin.
- Warnings were public weeks earlier. AMLBot named FXMR as a route for stolen Fetch.ai and SingularityNET money on 22 September, and money from later thefts kept arriving.
- The last chance to freeze stolen money is the moment before it changes into a privacy coin. Services on Hyperliquid can freeze funds, as one did with about $170,000 of Bitget's stolen money in October, but only if they choose to.
- An investigator's figures are evidence, not a verdict. The 87% and $20M claims come from one person's review of public data, and that person has received donations from the Hyperliquid Foundation.
COMMENTS