Hyperliquid Core Laundering: ZachXBT Ties 87% of FreedomXMR Inflows to Illicit Funds

On-chain investigator ZachXBT published an investigation on October 20 alleging that FreedomXMR (FXMR), a swap service running on Hyperliquid Core since August 2026, is a centralized laundering operation, with more than 87% of its inflow volume tied directly to illicit activity, per crypto.news. His manual review of every inflow above $10,000 traced more than $20 million to ransomware, exploits, malware and social engineering attacks.

The allegation targets the FXMR operators, not Hyperliquid. But it lands the same day Hyperliquid led every perp venue in fees, and it puts a spotlight on the permissionless listing design that lets anyone deploy a token on Hyperliquid Core. For traders, the question is less about headlines and more about what this kind of flow looks like on-chain and whether it changes anything about the venue's risk profile.

What ZachXBT Found in FreedomXMR Inflows

FXMR swaps deposited assets for Monero (XMR). ZachXBT compares its model to Wagyu's: the customer sends one asset and receives another, and the Monero leg obscures where the funds came from, according to Blockchain Reporter. Monero's transaction graph resists the kind of tracing used in the report, which is why the exit leg matters.

The incidents he links to FXMR inflows include the September 2026 exploits of DCENT Wallet, Fetch.ai and Axelar, an unnamed ransomware payment from September, and the October exploit of gambling platform Gamdom, per crypto.news. He named 0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 as the FXMR hot wallet and listed three more administrator controlled addresses.

On the supply side, the admin allegedly sources XMR liquidity through KuCoin, with more than 3,000 deposits from associated addresses. Both crypto.news and Blockchain Reporter stress that the report does not accuse KuCoin of knowingly taking part.

The limits of the numbers matter. The $20 million covers only inflows above $10,000, so lifetime volume is likely higher. The 87% figure refers to inflow volume, not all activity. And this is on-chain tracing published by an investigator, not a court finding, and it has not been independently verified.

How a $28,000 Ticker Auction Opened the Door

The FXMR ticker was secured in a Hyperliquid auction on July 27, 2026, for 518.28 HYPE. Reports put that at roughly $28,000 (crypto.news) to $31,000 (Bankless via Yahoo Finance) at the time, depending on the HYPE price used. Bankless reports that the winning bid came from one of the flagged admin addresses.

That auction is HIP-1 working as designed. Token deployment uses a Dutch auction that lets participants acquire deployment rights without permission from a centralized listing committee, and Hyperliquid's announcements state that user-deployed spot assets are not endorsed by the development team, per crypto.news. The same mechanism that makes spot listings on Hyperliquid Core open to anyone also means a laundering service can buy its way onto the venue for the price of a mid-sized trade.

Blockchain Reporter frames the economics bluntly: more than $20 million in traced inflows is roughly 700 times the entry cost. Bidding on a ticker is cheap relative to the flow a service can route through it.

Not the First Laundering Service on Hyperliquid Core

ZachXBT says several centralized laundering services, such as b1exch, have previously abused Hyperliquid Core's permissionless design, according to Bankless via Yahoo Finance. The same report notes that earlier in October he posted that he froze about $170,000 tied to the Bitget exploit at a service on Hyperliquid Core.

That detail cuts both ways. Funds sitting at a centralized operator on Hyperliquid Core could be frozen, which is more than can be said once they hit Monero. It also confirms that Hyperliquid Core is now an established route in post-exploit fund flows, which is a reputational issue the protocol will be asked about.

Blockchain Reporter links the report to an existing congressional insider trading probe that already names Hyperliquid, meaning the platform now faces scrutiny on both market integrity and anti money laundering fronts. ZachXBT says he shared a spreadsheet of supporting data with the Hyperliquid team. As of publication, no enforcement action or formal response from the protocol had been reported, per crypto.news.

Hyperliquid's $2.5M Fee Day and the AML Question

The timing is awkward for the bull case. Hyperliquid earned about $2.5 million in fees over 24 hours on October 20, against $198,000 for Lighter in second place and $123,000 for Aster in third, according to AMBCrypto citing data posted by HYPERDailyTK. Positions two through ten combined came to about $836,000, so Hyperliquid's take was roughly 3x the rest of the list.

Nothing in the report suggests FXMR flow is a meaningful share of that revenue. A swap service routing around $20 million in tracked inflows since August is small next to a venue printing millions in daily fees. The risk for HYPE holders is not the fee line. It is the regulatory narrative, at a moment when the Hyperliquid Policy Center is filing letter after letter with U.S. regulators arguing for onshore access to on-chain markets.

There is also a market side note. XMR is up about 73% since August 1, to about $620, against roughly 31% for Bitcoin over the same period, per Bankless via Yahoo Finance. The report does not attribute that move to FXMR, and a service sourcing XMR through a centralized exchange is not the same as spot demand on the open market. Treat any link as unproven.

What to Watch on Hyperliquid Core This Week

The open questions are concrete. Will the named wallets be frozen, will FXMR be delisted, and will any exchange act on the published addresses, as Blockchain Reporter lists them. A visible response from the Hyperliquid team would set a precedent for how permissionless spot listings get handled when an operator is publicly flagged.

For traders, the practical move is to treat the published addresses as data. Large outflows from the hot wallet after a public report can signal an operator moving funds ahead of a possible freeze, while a sudden halt in activity can point to the opposite. Buildix lets you follow Hyperliquid addresses through the whale tracker, which is where a flagged wallet's balance changes show up next to the rest of the venue's large accounts. On a venue where anyone can list, the wallet trail is often the first signal that a ticker has a problem.