Blockchain investigator ZachXBT has raised serious concerns about FreedomXMR, a cryptocurrency exchange service operating on Hyperliquid Core, after reporting that more than 87% of its incoming transaction volume was connected to suspected illegal activities. His investigation identified over $20 million in funds allegedly linked to ransomware attacks, cryptocurrency exploits, malware, and online fraud.
The findings, published on October 20, 2026, have brought renewed attention to the challenges of monitoring suspicious financial activity on permissionless blockchain networks.
FreedomXMR, also known as FXMR, reportedly began operating on Hyperliquid Core in August 2026.
According to ZachXBT, the service may have been used to move funds associated with several cryptocurrency security incidents.
The investigation also raised questions about Monero liquidity, exchange deposit activity, and the difficulties of identifying potentially suspicious operators on decentralized financial infrastructure.
ZachXBT Traces Over $20 Million in Suspicious FreedomXMR Transactions
ZachXBT’s investigation focused on historical incoming transactions involving amounts greater than $10,000.
After examining blockchain activity connected to FreedomXMR, the investigator concluded that more than 87% of the reviewed inflow volume was linked to suspected illicit sources.
He identified over $20 million associated with several categories of cybercrime, including ransomware payments, hacking incidents, malware-related theft, and social engineering scams.
These findings suggest that a substantial portion of the funds entering the service may have originated from compromised wallets, fraudulent activity, or other criminal operations.
However, the investigation does not provide a complete accounting of every transaction processed by FreedomXMR since its launch.
The $20 million figure represents funds ZachXBT attributed to identifiable incidents within the transactions he examined.
It should therefore not be interpreted as a verified total of all illicit funds that may have passed through the platform.
The allegations remain based on the investigator’s blockchain analysis rather than a publicly reported court finding or regulatory enforcement decision.
FreedomXMR Allegedly Received Funds From Major Crypto Exploits
The investigation identified several cryptocurrency-related security incidents as possible sources of funds entering FreedomXMR.
According to ZachXBT, transactions connected to incidents involving DCENT Wallet, Fetch.ai, and Axelar were among the transfers reviewed.
The reported activity included incidents dating to September 2026.
He also identified an unnamed ransomware payment from the same period.
In addition, funds allegedly connected to an October exploit involving the online gambling platform Gamdom appeared in the transaction analysis.
These connections suggest that FreedomXMR may have served as a destination for assets moving through several separate cybercrime-related incidents.
Blockchain investigators often examine transaction histories, wallet relationships, asset movements, and interactions with cryptocurrency services to identify suspicious patterns.
However, linking a transaction to a suspected source does not automatically establish that every person or platform handling those funds knowingly participated in a crime.
The precise nature of each transaction and the individuals responsible would require further investigation.
FreedomXMR’s Connection to Hyperliquid Raises Questions
FreedomXMR reportedly operates using infrastructure available on Hyperliquid Core.
Hyperliquid is a blockchain-based trading ecosystem that supports decentralized financial activity, including spot markets and derivatives.
One of its important features is the ability for users to deploy certain digital assets without seeking approval from a centralized exchange listing committee.
This permissionless approach allows developers and businesses to introduce tokens and trading markets with fewer traditional intermediaries.
However, it also creates challenges when potentially suspicious services use the same infrastructure.
According to ZachXBT, FreedomXMR is one example of a centralized exchange-style service operating within this environment.
The investigator compared the platform with b1exch, another service he previously associated with alleged cryptocurrency laundering activity.
These claims have renewed discussion about how blockchain ecosystems should respond when their technology is used by operators suspected of facilitating financial crime.
Importantly, the presence of a suspicious service on Hyperliquid does not by itself establish wrongdoing by the network’s developers or other users.
FreedomXMR Reportedly Acquired FXMR Ticker for 518.28 HYPE
Another detail highlighted in the investigation concerns the registration of FreedomXMR’s FXMR ticker.
According to ZachXBT, the ticker was acquired through a Hyperliquid auction on July 27, 2026.
The reported purchase cost was 518.28 HYPE tokens, worth approximately $28,000 at the time.
The auction occurred before FreedomXMR reportedly began operating in August.
Hyperliquid uses a token deployment system known as HIP-1, which allows participants to acquire deployment rights through a Dutch auction mechanism.
Under this process, token deployment costs are determined through an auction rather than a traditional application reviewed by a centralized listing authority.
The model is designed to support permissionless asset creation and open participation.
However, access to token deployment infrastructure should not be mistaken for an endorsement of the businesses using it.
Hyperliquid has previously explained that assets deployed by users are not officially approved or endorsed by its development team.
This distinction is important when evaluating the relationship between independent service operators and the blockchain networks they use.
Monero Liquidity and KuCoin Deposits Come Under Scrutiny
A significant part of ZachXBT’s investigation focused on how FreedomXMR allegedly obtained liquidity for Monero.
Monero, commonly known by its ticker XMR, is a cryptocurrency designed with privacy-focused transaction features.
Unlike transparent blockchains where many transaction details are publicly visible, Monero uses technology intended to conceal certain information about senders, recipients, and transferred amounts.
These privacy features serve legitimate purposes, including protecting financial confidentiality.
However, they can also make it more difficult for investigators to follow funds after they have been converted into XMR.
ZachXBT alleged that FreedomXMR’s administrator obtained Monero liquidity through cryptocurrency exchange KuCoin.
His analysis reportedly identified more than 3,000 deposits involving addresses associated with the service.
The frequency of these transfers drew attention to the potential role of centralized exchange infrastructure in the movement of funds connected to FreedomXMR.
However, the findings do not establish that KuCoin knowingly processed criminal proceeds or intentionally assisted the alleged activity.
Further evidence would be required to determine whether any compliance failures or legal violations occurred.
Why Monero Is Relevant to Cryptocurrency Investigations
Monero frequently appears in discussions about blockchain privacy because its transaction design differs significantly from many transparent cryptocurrency networks.
On public blockchains, investigators can often follow transfers from one address to another using blockchain explorers and specialized analytics tools.
This visibility makes it possible to identify transaction patterns and trace funds across multiple wallets.
Monero’s privacy mechanisms create additional challenges for this type of analysis.
As a result, investigators may focus on the points where funds enter or leave services that support Monero trading.
These points can sometimes provide useful information about deposits, withdrawals, or interactions with other cryptocurrencies.
In the FreedomXMR case, ZachXBT’s analysis focused partly on exchange deposits that he associated with obtaining XMR liquidity.
Nevertheless, using Monero is not inherently suspicious or illegal.
Many individuals choose privacy-focused cryptocurrencies for legitimate financial reasons, and privacy technology alone does not prove criminal intent.
KuCoin Has Faced Questions in Previous Investigations
The latest FreedomXMR allegations come after other blockchain investigations raised concerns about suspicious cryptocurrency transfers involving KuCoin deposit addresses.
In June 2026, ZachXBT highlighted a separate case involving approximately $250,000 in reportedly stolen funds.
That investigation examined alleged deposit addresses associated with KuCoin.
Another reported case involved the movement of approximately $120.2 million in USDT through multiple cryptocurrency services.
Following that investigation, stablecoin issuer Tether reportedly froze approximately $72.03 million connected to the case.
Although these incidents attracted attention, they involved separate transaction histories and allegations.
They do not establish that KuCoin knowingly participated in FreedomXMR’s alleged activities.
The distinction matters because an exchange can receive deposits from many users without necessarily knowing the full history of every asset involved.
Determining whether an exchange failed to meet legal or compliance obligations requires evidence beyond the existence of suspicious transfers.
Hyperliquid’s Permissionless Model Faces New Challenges
The FreedomXMR investigation also highlights a broader issue facing decentralized blockchain ecosystems.
Permissionless infrastructure is designed to allow people to build applications, create assets, and participate in financial markets without relying on a single approval authority.
Supporters argue that this model encourages innovation, accessibility, and competition.
However, the same openness can create opportunities for fraudulent projects and other high-risk operators.
When a suspicious service operates on a decentralized network, questions may arise about the responsibilities of developers, infrastructure providers, and ecosystem participants.
Hyperliquid has previously stated that its development team does not endorse independently deployed spot assets.
This means that users should not assume a project is legitimate simply because its token or market exists on the network.
The FreedomXMR allegations underline the importance of independent research and transparent risk assessment when interacting with unfamiliar cryptocurrency services.
At the same time, the investigation does not establish that Hyperliquid itself knowingly facilitated money laundering.
ZachXBT Shares Investigation Data With Hyperliquid Team
According to the published report, ZachXBT said he had shared a spreadsheet containing supporting blockchain information with the Hyperliquid team.
The material reportedly included transaction data and findings connected to FreedomXMR.
Sharing such information could help the relevant parties examine suspicious activity and assess whether additional action is necessary.
However, the investigator did not announce any confirmed enforcement action resulting from the disclosure.
There was also no reported confirmation that Hyperliquid had restricted FreedomXMR, blocked associated accounts, or introduced specific measures in response.
As a result, the immediate consequences of the investigation remain unclear.
Any future response would need to be evaluated based on official statements and verifiable actions rather than assumptions about what network operators might do.
Blockchain Investigations Continue to Expose Suspicious Fund Movements
ZachXBT has become widely known for investigating cryptocurrency exploits, stolen assets, and suspicious transaction networks.
His work often involves analyzing public blockchain records and connecting related wallet activity across multiple platforms.
Previous investigations have examined major cryptocurrency security incidents, including transactions associated with the 2025 Bybit hack.
An October 2026 report described his findings concerning an alleged laundering network linked to that exploit, including more than $12 million in traced funds.
These cases demonstrate how blockchain transparency can help investigators identify patterns even when assets move through numerous addresses and services.
However, public blockchain analysis also has limitations.
Wallet ownership, the intent behind transfers, and the legal status of particular transactions may not always be established from on-chain information alone.
For that reason, allegations based on transaction tracing should be distinguished from findings confirmed through legal proceedings or official investigations.
What Does the FreedomXMR Investigation Mean for Crypto Users?
For cryptocurrency users, the FreedomXMR case is another reminder that blockchain services can carry financial and operational risks.
A platform’s presence within a major blockchain ecosystem does not automatically make it trustworthy.
Users should exercise caution when interacting with unfamiliar exchange services, especially those providing limited information about their operators or business practices.
Unexpected restrictions, suspicious fund flows, poor transparency, or unclear withdrawal arrangements can create additional risks.
The investigation also demonstrates the importance of checking whether a token has been independently endorsed or simply deployed through an open protocol.
For blockchain developers, the case raises questions about how suspicious financial activity can be identified without undermining the openness of decentralized infrastructure.
For regulators and compliance teams, it highlights the continuing difficulty of tracking funds when assets move between transparent blockchains, centralized exchanges, and privacy-focused cryptocurrencies.
Final Thoughts
ZachXBT’s investigation into FreedomXMR has raised serious questions about the movement of suspected illicit funds through cryptocurrency services operating on Hyperliquid Core.
The investigator claims that more than 87% of the reviewed inflow volume was associated with illicit activity, including over $20 million allegedly connected to ransomware, cryptocurrency exploits, malware, and social engineering attacks.
His findings also highlighted the reported use of KuCoin for Monero liquidity and identified thousands of associated exchange deposits.
However, the allegations do not establish wrongdoing by Hyperliquid or KuCoin, and no formal enforcement outcome was reported in the supplied investigation.
The case illustrates the challenges facing permissionless blockchain ecosystems as they balance open access with growing concerns about financial crime.
For now, the investigation serves as a reminder that greater accessibility in cryptocurrency markets must be accompanied by careful risk assessment, transparent reporting, and responsible use of blockchain infrastructure.
