ZachXBT: Over 87% of the inflow funds into the money laundering service FreedomXMR on HL Core are related to illegal activities

On-chain detective ZachXBT stated that in August 2026, a centralized money laundering service named FreedomXMR (FXMR) appeared on Hyperliquid Core (HL Core). Over 87% of its incoming funds are directly related to illegal activities.

Through manual verification, it was found that among all historical inflows over $10,000 to FXMR, more than $20 million directly originated from ransomware attacks, exploits, malware, and social engineering attacks, including: the DCENT wallet exploit incident (September 2026), the Fetch.ai exploit incident (September 2026), the Axelar exploit incident (September 2026), a certain ransomware payment (September 2026, specific source undisclosed), and the Gamdom exploit incident (October 2026). The operators of this service obtained XMR liquidity from KuCoin (over 3,000 deposits), suspected of using a similar exchange model to Wagyu.

The token name (ticker) FXMR was acquired by the operators at an HL auction on July 27, 2026, for 518.28 HYPE (approximately $28,000). Several such centralized money laundering services had previously appeared on HL Core, exploiting the chain's "permissionless" design features and its wide application for illegal money laundering activities. Relevant data tables have been shared with the Hyperliquid team.