Choose Rich Live
Crypto News

ZachXBT links over 87% of FreedomXMR deposits to illicit activity

On-chain investigator ZachXBT reported that FreedomXMR, a Monero swap service operating on Hyperliquid Core, received more than 87% of its deposits from illicit sources, tracing over $20 million to ransomware and exploits.

Graphic artwork featuring the Monero logo against an orange circular background surrounded by floating orbs.
Image: @Bankless

On-chain investigator ZachXBT reported that more than 87% of the inflows to FreedomXMR, a Monero swap service running on Hyperliquid Core, originated from illicit activity. By reviewing historical deposits exceeding $10,000, the investigator traced more than $20 million in funds directly to ransomware, exploits, malware, and social engineering attacks.[1][2][3][4]

According to ZachXBT, the laundered funds originated from several known security incidents, including exploits involving DCENT Wallet, Fetch.ai, Axelar, and Gamdom. FreedomXMR emerged in August as a centralized laundering service, with its administrator sourcing Monero liquidity through KuCoin via more than 3,000 deposits to the centralized exchange.[1][2][3]

ZachXBT stated that the supporting on-chain evidence behind the findings has been provided directly to the Hyperliquid team.[1][2]

Key facts

  • ZachXBT reported that over 87% of inflows to FreedomXMR were linked to illicit activity.
  • The investigation traced more than $20 million in historical deposits over $10,000 to ransomware, hacks, malware, and social engineering.
  • Incidents linked to FreedomXMR inflows include exploits involving DCENT Wallet, Fetch.ai, Axelar, and Gamdom.
  • FreedomXMR is a Monero swap service operating on Hyperliquid Core that emerged in August.
  • FreedomXMR's operator allegedly sourced Monero liquidity through KuCoin across more than 3,000 deposits.
  • ZachXBT shared the supporting on-chain evidence with the Hyperliquid team.

Sources 路 4 sources

  1. BL

    BlockNews@blocknewsdotcomPost on X 路

    馃毃 LATEST: Onchain investigator ZachXBT alleges that over 87% of inflows to FreedomXMR, a service operating on Hyperliquid Core, are linked to ILLICIT activity. 馃憖 His investigation traced more than $20 MILLION in deposits to ransomware, hacks, malware and social engineering attacks, including incidents involving DCENT Wallet, https://t.co/S4iaF0RM99, Axelar and Gamdom. ZachXBT describes FreedomXMR as a centralized crypto laundering service, alleging its operator sources Monero liquidity through KuCoin, with over 3,000 associated exchange deposits. He says the supporting onchain evidence has been shared with the Hyperliquid team.

    Open source
  2. CB

    Coin Bureau@coinbureauPost on X 路

    馃毃NEW: ZachXBT says over 87% of inflows to FreedomXMR, a service operating on Hyperliquid Core, are directly linked to ILLICIT activity. Reviewing historical deposits above $10,000, the investigator traced more than $20 MILLION to ransomware, exploits, malware and social engineering, including incidents involving DCENT Wallet, Fetch .ai, Axelar and Gamdom. ZachXBT describes FXMR as a centralized laundering service that emerged in August. He says its administrator sources Monero liquidity from KuCoin, with associated addresses making over 3,000 deposits to the exchange. He has shared the supporting onchain data with the Hyperliquid team.

    Open source
  3. BA

    Bankless@BanklessPost on X 路

    NEWS: ZachXBT uncovered Monero laundering pipeline on Hyperliquid Core known as FreedomXMR, which has taken in $20M+ in inflows since August. The funds trace back to ransomware, malware, social engineering, and exploits including DCENT Wallet, Fetch, and Gamdom. Since August, $XMR is up 69% while $BTC is up 30%.

    Open source
  4. BA

    BanklessArticle 路

    ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid More than 87% of inflows to FreedomXMR, a Monero swap service on Hyperliquid Core, came from illicit activity, with $20M+ traced to hacks and ransomware.

    Open source