ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid
More than 87% of inflows to FreedomXMR, a Monero swap service on Hyperliquid Core, came from illicit activity, with $20M+ traced to hacks and ransomware.
Onchain investigator ZachXBT says FreedomXMR (FXMR), a centralized laundering service that appeared on Hyperliquid Core in August, has drawn more than 87% of its inflow volume directly from illicit activity, per his Telegram channel. XMR is up ~73% since Aug. 1 to ~$620, more than double bitcoin's ~31% gain.
What's the Scoop?
Dirty Inflows: A manual review of every FXMR inflow above $10K traced $20M+ to ransomware, exploits, malware and social engineering, ZachXBT wrote. He named September's DCENT Wallet, Fetch.ai and Axelar exploits, an unnamed ransomware payment and October's Gamdom exploit.
How It Works: The admin sources XMR liquidity from KuCoin, with 3K+ deposits to the exchange, and likely uses a swap model similar to Wagyu's, per ZachXBT.
A $31K Ticker: One of the flagged admin addresses won the FXMR ticker in Hyperliquid's permissionless auction on July 27 for 518.28 HYPE, roughly $31K at the time, a cheap way onto one of crypto's busiest venues.
Not the First: ZachXBT says several centralized laundering services, such as b1exch, have abused HL Core's "permissionless design and adoption," and that he's shared a spreadsheet of source data with the Hyperliquid team. Earlier this month, he said he "Froze ~$170K total for the Bitget exploit at a service on HL Core recently." Hyperliquid had not publicly responded as of publication.
David Christopher
David is a writer/analyst at Bankless. Prior to joining Bankless, he worked for a series of early-stage crypto startups and on grants from the Ethereum, Solana, and Urbit Foundations. He graduated from Skidmore College in New York. He currently lives in the Midwest and enjoys NFTs, but no longer participates in them.
