BlockBeats news, October 20: On-chain investigator ZachXBT posted that a centralized money laundering service called FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026, with over 87% of its inflow transaction volume directly linked to illicit activities.
ZachXBT manually reviewed FXMR's historical transactions with single inflows exceeding $10,000 and found that over $20 million in funds can be directly traced to ransomware, exploit attacks, malware, and social engineering incidents, involving the September 2026 attacks related to DCENT Wallet, Fetch.ai, and Axelar, as well as unnamed ransomware payments and the October Gamdom attack incident.
ZachXBT also noted that FXMR administrators obtain Monero (XMR) liquidity through KuCoin, with related addresses having cumulatively deposited funds to KuCoin more than 3,000 times, and its operating model may be similar to Wagyu's exchange model. The FXMR token ticker was purchased through a Hyperliquid auction on July 27, 2026, at a final price of 518.28 HYPE, approximately $28,000 at the price at that time.
ZachXBT stated that Hyperliquid Core has previously seen centralized money laundering services such as b1exch, which exploit on-chain permissionless mechanisms to conduct activities, and said he has shared a spreadsheet containing relevant data with the Hyperliquid team. The above fund tracing and illicit association ratios are ZachXBT's investigation conclusions.

