ZachXBT Alleges More Than $20M in Illicit Flows Through Hyperliquid Service

On Oct. 20, ZachXBT alleged that cybercrime-linked funds exceeding $20 million entered FreedomXMR, a swap service on Hyperliquid Core, putting scrutiny on the service’s operators.

ZachXBT said more than 87% of FreedomXMR’s incoming volume was connected to illicit activity. A manual review of historical inflows above $10,000 traced funds to ransomware, exploits, malware and social engineering, he said.

Incidents he identified involved DCENT Wallet, Fetch.ai and Axelar in September 2026, and Gamdom in October. He also alleged the service’s operator sourced Monero (XMR) through KuCoin and that associated addresses made more than 3,000 deposits to the exchange. ZachXBT said he sent the Hyperliquid team a spreadsheet containing the data behind his claims.

The allegations concern FreedomXMR’s operators. ZachXBT did not allege that Hyperliquid operated the service. He said FreedomXMR appeared on Hyperliquid Core in August 2026. Hyperliquid’s HIP-1 standard permits users to deploy spot tokens through a Dutch auction, and Hyperliquid says it does not endorse user-deployed assets.