ZachXBT Uncovers Money Laundering Network on Hyperliquid Core

Renowned on-chain investigator ZachXBT has released a detailed report exposing FreedomXMR (FXMR), a centralized money laundering service operating on the Hyperliquid Core (HL Core) network. According to the findings published on October 20, 2026, more than 87% of the total capital flowing into the platform is directly associated with illicit activities. The analysis highlights a growing trend of bad actors utilizing specialized privacy tools within decentralized finance (DeFi) ecosystems to obfuscate the origins of stolen digital assets.

Detailed Analysis of Illicit Fund Inflows

The investigation involved a manual audit of historical transactions processed by FXMR. ZachXBT focused on inflows exceeding $1,000, discovering that over $30 million originated from various cybercrimes. The data suggests that since the service's emergence in August 2026, it has become a primary hub for cybercriminals seeking to wash funds obtained through malicious means.

The report identifies several specific sources of these illegal funds:

• Ransomware attacks targeting corporate infrastructure.
• Exploitation of smart contract vulnerabilities.
• Malware and social engineering campaigns.
• The DCENT wallet exploit occurring in September 2026.
• The high-profile Fetch exploit involving significant asset loss.

Operational Context of FreedomXMR

FreedomXMR operates as a bridge or mixing service, often leveraging the privacy features of Monero (XMR) or similar protocols to disconnect the link between the sender and receiver on public ledgers like Hyperliquid Core. This high concentration of "dirty" capital—nearly nine out of every ten dollars—indicates that the platform is not merely a privacy tool for retail users but a dedicated utility for professional hackers. ZachXBT’s findings underscore the challenges faced by the Hyperliquid ecosystem as it balances permissionless innovation with the necessity of preventing large-scale financial crime.

Manual checks revealed that out of all historical inflows to FXMR exceeding $1,000, over $30 million directly originated from ransomware attacks, exploits, malware, and social engineering attacks.

The revelation regarding FreedomXMR places renewed pressure on blockchain developers and regulatory bodies to monitor centralized gateways within L1 and L2 networks. As the HL Core ecosystem continues to mature, the presence of such high-volume laundering services remains a critical point of concern for institutional and retail participants alike. The ongoing efforts of independent researchers like ZachXBT continue to serve as a vital component of security and transparency in the rapidly evolving cryptocurrency landscape.