Most FreedomXMR funds traced to hacks and ransomware, researcher finds
Security & Exploits ·
An on-chain investigation attributes more than 87% of deposits flowing into the Hyperliquid-based mixer FreedomXMR to criminal proceeds, with over $20 million tied to known breaches.
Researcher ZachXBT examined transaction records tied to FreedomXMR, a centralized privacy-coin conversion service that appeared on Hyperliquid Core in August 2026, and concluded that the overwhelming majority of its inflows originate from illicit sources rather than ordinary users seeking financial privacy, according to wublockchain.xyz. The finding stems from a dataset limited to transfers above $10,000, a threshold chosen to isolate larger, more traceable movements of funds.
Within that pool of larger transactions, the analysis attributes upward of $20 million to a cluster of security incidents, among them the DCENT Wallet compromise, the Fetch.ai exploit, the Axelar breach, and an attack affecting Gamdom. The pattern suggests FreedomXMR functioned as a conversion point where stolen or extorted crypto assets were swapped into monero, a cryptocurrency designed to obscure transaction trails, making subsequent fund tracing considerably harder for investigators.
The investigation also mapped how the service itself obtained its monero supply. It found that FreedomXMR's operator relied on KuCoin as a liquidity source, with wallets connected to the administrator depositing to the exchange more than 3,000 times. That volume of repeated deposits points to a sustained operational relationship between the laundering service and a centralized exchange, rather than a one-off or small-scale sourcing arrangement.
ZachXBT has passed the underlying on-chain evidence to the Hyperliquid team, raising the question of whether the platform will take action against addresses or infrastructure associated with FreedomXMR. No response or enforcement step from Hyperliquid has been disclosed alongside the findings.
The case adds to a recurring theme in crypto security reporting: services built to anonymize funds on newer or less-scrutinized venues can become default off-ramps for hackers soon after launch, sometimes within months of going live. Coverage of the findings has appeared across at least two sources tracking the cluster, indicating the data has drawn attention beyond a single outlet.
What remains unclear is whether KuCoin has been notified of or has responded to the deposit pattern linked to FreedomXMR's administrator, and whether any funds tied to the named exploits can still be frozen or recovered. Also unresolved is whether Hyperliquid will restrict the service at the protocol or interface level, or whether enforcement will fall instead to the exchanges supplying its liquidity.