Hyperliquid

Monero

Axelar

ZachXBT

<ul>
 <li>ZachXBT alleges that more than 87% of FreedomXMR’s incoming volume is linked to illicit activity.</li>
 <li>The service reportedly used Hyperliquid’s HIP-1 token infrastructure and sourced Monero liquidity through KuCoin.</li>
 <li>The investigation creates separate questions for the token’s deployer, Hyperliquid’s trading interfaces and exchanges handling associated funds.</li>
</ul>
Blockchain investigator ZachXBT has identified more than $20 million in suspected illicit cryptocurrency deposits to FreedomXMR, a centralized swap service associated with a token deployed on Hyperliquid Core.
His October 20 findings, <a href="https://t.me/investigations" rel="noopener noreferrer nofollow">shared in Telegram</a>, &nbsp;connect incoming funds to ransomware, malware, exploits and social engineering attacks, including incidents involving DCENT Wallet, Fetch.ai, Axelar and Gamdom. ZachXBT estimates that illicit sources account for more than 87% of the service’s incoming transaction volume.
The investigation presents a concrete problem for Hyperliquid: suspicious activity may be connected to a token listed through its open deployment system, while the service handling customer funds operates separately from the exchange.
<h2 id="what-hyperliquid-can-restrict-and-what-it-cannot">What Hyperliquid Can Restrict and What It Cannot</h2>
FreedomXMR reportedly acquired the FXMR ticker through Hyperliquid’s HIP-1 deployment auction in July, paying 518.28 HYPE.
HIP-1 enables native token creation and spot trading without a conventional exchange listing committee. <a href="https://hyperliquid.gitbook.io/hyperliquid-docs/hyperliquid-improvement-proposals-hips/hip-1-native-token-standard?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">Its technical documentation</a> describes the auction and token deployment process.
Once a token exists, enforcement becomes more complicated than rejecting a listing application.
A frontend operator could potentially stop displaying a market or facilitating access through its interface. That would not automatically remove the token from the underlying network or prevent users from accessing it through other supported interfaces.
Changes at the protocol or validator level would involve a different technical and governance process. It would be inaccurate to assume that Hyperliquid can only intervene through its website, or that validators can arbitrarily erase a deployed token.
Most importantly, FreedomXMR’s alleged swap activity appears to involve operator-controlled deposit addresses. Restricting the FXMR trading interface would not necessarily stop customers from sending cryptocurrency directly to those addresses.
<h2 id="the-technical-detail-traders-should-check">The Technical Detail Traders Should Check</h2>
Hyperliquid’s deployment API contains two features relevant to this case that are missing from most coverage.
First, HIP-1 tokens can have a configurable deployer trading-fee share. The default is 100% of eligible fees collected in the base token, but deployers can lower that percentage. This does not mean an FXMR operator received 100% of all trading fees or earned revenue from the alleged external laundering flows. The actual token configuration and fee transfers would need to be checked.
Second, Hyperliquid’s official deployment SDK includes an optional token-freezing capability. That means the relevant question is not simply whether <a href="https://ethnews.com/hyperliquid-pushes-sec-to-close-gap-in-crypto-trading-rules/" rel="noopener noreferrer nofollow">Hyperliquid is</a> decentralized, but whether FXMR was deployed with freeze privileges enabled, who controls those privileges and what they can restrict. The SDK example disables freezing by default; it does not establish FXMR’s configuration.
For anyone trading an unfamiliar HIP-1 token, those details are more useful than the token’s ticker or its appearance on an exchange interface. They help identify potential issuer control over balances and whether the deployer may receive fees from market activity.
<h2 id="the-evidence-still-missing">The Evidence Still Missing</h2>
ZachXBT says the operator sourced Monero liquidity through KuCoin and that associated addresses made more than 3,000 exchange deposits. That provides investigators with a possible route to identify exchange accounts, but the deposit count alone does not establish the value or illicit origin of each transfer.
<h3 id="the-next-questions-are-specific">The next questions are specific:</h3>
<ul>
 <li>For Hyperliquid: What controls exist for FXMR, and has the team identified any actionable link between the alleged swap operation and the token’s trading activity?</li>
 <li>For KuCoin: Were the identified deposit addresses associated with accounts already under review, and were any restrictions imposed?</li>
 <li>For investigators: Can the published tracing be reconciled with exchange records and actual Monero purchases?</li>
</ul>
There is no verified public answer to those questions in the sources reviewed. The available reporting also does not establish that HYPE holders received revenue attributable to the suspected deposits.
The investigation’s immediate value is the identification of a suspected laundering network and addresses that counterparties can examine. Whether it leads to restrictions depends on the evidence connecting those addresses to accounts, token controls and transactions, not simply on the fact that FXMR was deployed on Hyperliquid.
The post <a href="https://ethnews.com/zachxbt-exposes-alleged-20m-laundering-route-on-hyperliquid/" rel="noopener noreferrer nofollow">ZachXBT Exposes Alleged $20M Laundering Route on Hyperliquid</a> appeared first on <a href="https://ethnews.com" rel="noopener noreferrer nofollow">ETHNews</a>.

ZachXBT Exposes Alleged $20M Laundering Route on Hyperliquid

Table of Contents

ETHNews

Other articles published on Oct 21, 2026

Join our free newsletter for daily crypto updates!