FreedomXMR (FXMR), a centralized laundering service on Hyperliquid Core, has funneled $20M+ from ransomware and exploit incidents since August 2026.
Security & Exploits ·
FreedomXMR (FXMR), a centralized laundering service deployed on Hyperliquid Core in August 2026, has processed over $20 million in illicit funds, with more than 87 percent of its inflow volume traced to ransomware, exploits, and malware incidents. Manual analysis of large historical deposits linked the service to specific theft events, including the DCENT Wallet, Fetch.ai, and Axelar exploits in September 2026, a Gamdom exploit in October 2026, and unnamed ransomware payments. The operator sources monero liquidity via multiple deposits to KuCoin and likely employs a swap mechanism comparable to prior laundering models observed on the chain.
The FXMR ticker was acquired in a Hyperliquid Core auction on July 27, 2026 for 518.28 HYPE, worth approximately $28,000 at the time. Hyperliquid Core's permissionless design has enabled multiple centralized laundering services to operate, with FreedomXMR joining platforms such as b1exch in abusing the chain's architecture.
The identified FXMR hot wallet and three associated admin addresses remain active on-chain. Analysis data has been shared with the Hyperliquid team, though enforcement mechanisms and the service's continued operational status remain unclear.