On-chain investigator ZachXBT has released a report detailing the operations of the swap service FreedomXMR, which functions on the Hyperliquid Core platform. The service, identified by the FXMR ticker, launched in August 2026 and operates as a centralized platform for laundering funds despite its decentralized environment.
According to the investigation, over 87% of all inflows into FreedomXMR are linked to illicit activities. A manual analysis of transactions exceeding $10,000 revealed that more than $20 million originated from ransomware attacks, malware distribution, social engineering, and various exploits, including those involving DCENT Wallet, Fetch.ai, and Axelar.
The service utilizes a swap model where users exchange assets for Monero. ZachXBT identified over 3,000 deposits associated with the service and noted that the operator sources Monero liquidity from the KuCoin exchange. The report clarifies that these findings do not imply any wrongdoing by KuCoin itself.
The operator of FreedomXMR secured the FXMR ticker through a Hyperliquid auction, paying 518.28 HYPE, which was valued at approximately $28,000 at the time. Hyperliquid Core operates on a permissionless design, allowing any winner of a ticker auction to deploy assets without oversight, a feature previously utilized by other laundering services.
