A new allegation involving cryptocurrency flows on Hyperliquid has drawn attention to the challenges of identifying and tracking potentially illicit funds across blockchain networks. According to a report shared by Wu Blockchain, on-chain investigator ZachXBT found that more than 87% of inflows to FreedomXMR (FXMR), a service described as a centralized cryptocurrency laundering operation, were linked to suspected illicit activity.

The reported investigation examined historical inflows exceeding $10,000 per transaction and allegedly traced more than $20 million to sources associated with ransomware, cryptocurrency exploits and social engineering attacks. The incidents reportedly included activity involving DCENT Wallet, Fetch.ai, Axelar and Gamdom.

The findings raise questions about the use of trading platforms, token conversions and cross-chain transfers in moving funds associated with suspected criminal activity. They also highlight the importance of transaction monitoring and cooperation between blockchain investigators, exchanges and decentralized finance platforms.

However, the figures should be treated as investigative allegations rather than established legal findings. The specific FreedomXMR investigation and its full supporting evidence could not be independently verified through the publicly available sources reviewed for this article.

Key Takeaways

• Wu Blockchain reported that ZachXBT linked more than 87% of FreedomXMR inflows to suspected illicit activity.
• The investigation reportedly traced over $20 million in historical inflows associated with ransomware, exploits and social engineering attacks.
• DCENT Wallet, Fetch.ai, Axelar and Gamdom were among the incidents mentioned in the report.
• The investigator reportedly identified Monero liquidity sourced through KuCoin and more than 3,000 deposits to the exchange from associated addresses.
• The reported findings have been shared with the Hyperliquid team, according to the source.
• The allegations do not establish that every transaction, wallet or service connected to the investigation was involved in a crime.

What Is FreedomXMR (FXMR)?

FreedomXMR, identified in the report by the ticker FXMR, is described as a centralized money-laundering service that emerged on Hyperliquid Core in August 2026.

According to the allegations, the service received cryptocurrency from wallets associated with a range of suspected criminal activities. These included ransomware operations, exploits targeting cryptocurrency projects and social engineering schemes designed to persuade victims to transfer their assets.

The reported investigation focused on historical inflows above $10,000 per transaction. That threshold can help investigators prioritize larger transfers when tracing funds through multiple wallets and services.

Nevertheless, transaction size alone does not establish criminal intent. Legitimate traders, market makers, exchanges and other financial participants also move substantial amounts of cryptocurrency. Determining whether funds are illicit requires additional evidence, including transaction histories, links to known incidents and reliable attribution of wallet addresses.

The available reporting does not independently establish the legal status of FreedomXMR or provide enough verified information to assess every transaction attributed to the service.

ZachXBT's Reportedly Traced More Than $20 Million in Inflows

The central claim in the report concerns the origin of funds entering FreedomXMR.

Wu Blockchain reported that ZachXBT analyzed historical inflows exceeding $10,000 and traced more than $20 million to activity associated with ransomware, cryptocurrency exploits and social engineering attacks.

These categories represent different methods of obtaining cryptocurrency unlawfully.

Ransomware operators typically demand payment after restricting access to a victim's systems or threatening to release stolen information. Cryptocurrency exploits can drain assets from vulnerable smart contracts, wallets or related infrastructure. Social engineering attacks use deception, impersonation or manipulation to convince people to disclose credentials or authorize transfers.

Once funds have been stolen, investigators may follow them through several wallets, token swaps, bridges, centralized exchanges and other services. Such movements can complicate investigations because the trail may cross multiple blockchain networks and involve intermediaries in different jurisdictions.

The reported $20 million figure refers to the value of transactions allegedly traced to suspicious sources. It should not automatically be interpreted as the total amount stolen by FreedomXMR, the service's revenue, or a confirmed loss attributable to a single incident.

The distinction matters because tracing funds through a service does not, by itself, prove that the service operator knew the origin of every deposit or personally participated in the original theft.

Which Crypto Incidents Were Reportedly Linked to FreedomXMR?

The report referenced several incidents or entities while describing the alleged inflows.

DCENT Wallet

DCENT Wallet has been associated with a separate reported security incident involving XRP. Coverage published in September 2026 described approximately 11.75 million XRP moving out of 6,678 wallets between September 15 and September 20.

The reported investigation into those transfers described the use of AccountDelete transactions and subsequent movement through additional services. However, that separate incident does not independently confirm that the proceeds reached FreedomXMR. The exact connection requires supporting transaction evidence.

Fetch.ai

The report also mentioned activity associated with Fetch.ai. A September 22, 2026, analysis republished by KuCoin's news platform described an alleged exploit-related fund movement in which approximately 100 ETH was converted into roughly 266,000 USDC, bridged to Arbitrum and deposited into Hyperliquid before being converted into FXMR.

That reporting provides relevant context for why FXMR appeared in discussions of suspicious fund movements. It does not, by itself, verify the broader claim that more than 87% of FreedomXMR's total inflows were illicit.

Axelar

Axelar was also named among the incidents reportedly connected to the investigation. The available material reviewed for this article did not establish the precise transaction path or independently confirm the amount allegedly associated with Axelar-related activity.

Further transaction-level evidence would be necessary to determine how the relevant funds moved and whether they can be attributed reliably to a specific exploit.

Gamdom

Gamdom was another entity mentioned in the report. Its inclusion should not be interpreted as evidence that the company itself participated in laundering or other criminal activity. Establishing such a connection would require clear evidence identifying the relevant wallets, transactions and parties.

Taken together, these references suggest that the reported investigation examined funds associated with multiple types of alleged wrongdoing. The strength of each individual connection depends on the supporting evidence.

The Reported KuCoin Connection and Monero Liquidity

Another significant claim concerns the sourcing of Monero liquidity.

According to Wu Blockchain's summary, ZachXBT found that FreedomXMR's administrator sourced XMR liquidity from KuCoin, while associated addresses made more than 3,000 deposits to the exchange.

This is an allegation about transaction flows, not proof that KuCoin knowingly facilitated criminal activity.

Centralized exchanges routinely process deposits from many users and blockchain addresses. Investigators may identify exchange deposit addresses as part of a tracing process, but establishing the identity of an account holder or determining whether an exchange violated its obligations requires additional information.

Monero is a privacy-focused cryptocurrency designed to provide stronger transaction privacy than transparent blockchains such as Bitcoin or Ethereum. Its privacy features can make certain aspects of transaction tracing more difficult, although the level of visibility depends on the particular transaction path and the information available to investigators.

When investigators trace funds moving between transparent blockchain networks and privacy-oriented assets, they may rely on exchange records, publicly observable transfers, timing patterns and other corroborating evidence.

The reported KuCoin connection illustrates why coordination between blockchain analytics firms, exchanges and law enforcement can matter when investigating potentially illicit financial flows.

Why Hyperliquid Matters in the Investigation

Hyperliquid is a blockchain-based trading ecosystem known for its decentralized perpetual futures market. Its infrastructure allows users to interact with crypto markets and move assets through supported blockchain mechanisms.

Like other digital-asset platforms, the broader ecosystem faces the challenge of distinguishing legitimate financial activity from transfers associated with scams, hacks and other suspected crimes.

On-chain data can help investigators identify suspicious patterns, but public transaction visibility does not mean that every participant's real-world identity is known. Attribution often depends on linking wallet activity to other evidence, such as exchange records, incident disclosures or information supplied by victims and investigators.

The FreedomXMR allegations therefore raise broader questions about how suspicious flows are detected, how quickly relevant information reaches platforms and what procedures are available when investigators identify addresses associated with alleged criminal activity.

The report says ZachXBT shared supporting on-chain data with the Hyperliquid team. The material reviewed for this article did not independently establish what action, if any, the team subsequently took.

It would be premature to conclude that Hyperliquid itself knowingly facilitated laundering based solely on the reported transactions.

How On-Chain Investigators Trace Suspected Laundering Activity

Blockchain investigations commonly begin with a known address, transaction or incident. Investigators then follow the movement of funds across relevant transactions and compare the resulting pattern with other available evidence.

Several methods can contribute to the process.

Transaction tracing: Investigators examine transfers between addresses to reconstruct how assets moved from an initial source to later destinations.

Address clustering: Multiple addresses may be assessed for potential connections based on transaction behavior, shared counterparties and other signals. A cluster is an analytical conclusion, not automatic proof that one person controls every address.

Cross-platform analysis: Funds may move through bridges, exchanges or token-conversion services. Investigators compare activity across these systems to determine whether separate transactions are connected.

Incident attribution: Researchers compare wallet activity with previously identified hacks, phishing campaigns, ransomware incidents or other documented events.

Evidence sharing: Investigators may provide relevant transaction information to exchanges, platforms or law enforcement, allowing them to assess whether additional action is warranted.

These methods can reveal important patterns, but they also have limitations. Shared services can create apparent connections between unrelated users, and transaction timing alone may not prove common ownership or criminal intent.

Strong conclusions require multiple supporting indicators and transparent explanations of how the evidence was interpreted.

What the 87% Figure Does—and Does Not—Mean

The reported figure that more than 87% of FreedomXMR inflows were associated with illicit activity is the headline statistic, but its methodology is important.

The report's summary does not provide enough independently verifiable detail to establish the full denominator, the precise classification criteria or the confidence level assigned to each attributed transaction.

For example, an investigator might classify an inflow as suspicious because it originated from a wallet previously linked to a confirmed exploit. Another transaction might be considered suspicious because it passed through an address cluster associated with suspected criminal activity. These classifications are not necessarily equivalent.

A reliable assessment would ideally disclose the transaction sample, the period analyzed, the addresses examined, the attribution methods used and whether the amount represents gross inflows, unique funds or transfers that may have been counted more than once.

Without that information, the 87% figure should be attributed to the reported investigation rather than presented as an independently established measurement.

The same caution applies to the reported $20 million total. It is a useful indication of the scale alleged by the investigator, but it should not be confused with a confirmed criminal judgment or a final estimate of recoverable losses.

What Happens When Investigators Share On-Chain Evidence?

Sharing evidence with a platform can allow its security or compliance team to review identified transactions and determine whether they warrant further investigation.

Depending on the platform, applicable law and the quality of the evidence, possible responses may include enhanced transaction monitoring, a request for additional information, restrictions on specific accounts where legally justified, or referrals to appropriate authorities.

However, sharing an investigation with a platform does not establish that the platform has confirmed every allegation. Nor does it guarantee that assets can be frozen or recovered.

Cryptocurrency transactions may be irreversible at the protocol level, while recovery can depend on where funds are held, whether an intermediary can act, and whether authorities can identify the people responsible.

The next meaningful development in the FreedomXMR case would be additional verifiable evidence, a substantive response from relevant parties or a documented enforcement action. Until then, the reported findings remain allegations that warrant careful examination.

Conclusion

The reported FreedomXMR investigation highlights a recurring challenge in digital finance: cryptocurrency transactions can be publicly traceable in some environments while still passing through complex networks of wallets, exchanges and conversion services.

Wu Blockchain reported that ZachXBT linked more than 87% of FreedomXMR inflows to suspected illicit activity and traced over $20 million to sources associated with ransomware, exploits and social engineering attacks. The report also described alleged links to Monero liquidity sourced through KuCoin and said the investigator shared supporting information with Hyperliquid.

Those claims are significant, but their full scope and accuracy require transaction-level verification and, where relevant, responses from the parties involved.

For the wider crypto industry, the episode underscores the value of transparent investigative methods, effective monitoring and cooperation between platforms and independent researchers. It also demonstrates why allegations involving specific services, exchanges or projects should be evaluated carefully rather than treated as established criminal findings before the supporting evidence is available.

Frequently Asked Questions

What is FreedomXMR (FXMR)?

FreedomXMR is described in the report as a centralized service associated with Hyperliquid Core. Wu Blockchain's summary attributes allegations of illicit fund flows to the service, but its full legal and operational status was not independently verified for this article.

What did ZachXBT reportedly find?

According to Wu Blockchain, ZachXBT linked more than 87% of FreedomXMR inflows to suspected illicit activity and traced more than $20 million to sources associated with ransomware, exploits and social engineering attacks.

Which incidents were mentioned in the investigation?

The report referenced DCENT Wallet, Fetch.ai, Axelar and Gamdom. The precise transaction-level links and the evidence supporting each attribution require further verification.

Was KuCoin proven to have participated in laundering?

No. The reported investigation alleged that FreedomXMR's administrator sourced Monero liquidity from KuCoin and that associated addresses made more than 3,000 deposits. Those claims do not establish that KuCoin knowingly facilitated criminal activity.

Did Hyperliquid confirm the allegations?

The source report says ZachXBT shared supporting on-chain data with the Hyperliquid team. An independent confirmation of the full allegations or any subsequent enforcement action was not established in the material reviewed.

Can cryptocurrency investigators recover stolen funds?

Sometimes, but recovery is not guaranteed. Investigators may trace transfers and share evidence with exchanges or law enforcement. The outcome depends on where the assets have moved, whether intermediaries can intervene and whether the responsible parties can be identified.

---

Editorial disclosure: This article summarizes reported allegations and available contextual reporting. It does not establish criminal liability for any named person, platform, exchange or project. The article is for informational purposes only and is not investment or legal advice.

Sources

1. Wu Blockchain — original report supplied for this article: https://x.com/WuBlockchain
2. KuCoin — September 22, 2026, analysis discussing alleged Fetch.ai-related fund movements into FXMR: https://www.kucoin.com/news/insight/ETH/6ab2cec874fd460007c4d2a5
3. TimesWeb3 — reporting on the separate DCENT Wallet incident: https://timesweb3.com/news/dcent-drain-20m-in-xrp-pulled-from-6678-wallets/