ZachXBT Links FreedomXMR to $20 Million in Illicit Crypto Flows, Sparking Regulatory Debate

A detailed investigation by the pseudonymous crypto researcher ZachXBT reveals that FreedomXMR (FXMR), a permissionless exchange launched on Hyperliquid Core in August, has become a focal point for high‑value money‑laundering activities. The study finds that more than 87 % of inbound transaction volume on the platform is tied to illicit finance.

Large‑Scale Illicit Inflows Identified

According to ZachXBT’s manual review, over $20 million in transactions exceeding $10,000 each can be traced to a series of recent cybersecurity incidents, including ransomware campaigns, smart‑contract exploits, and malware‑driven thefts. The findings have ignited a broader discussion about the responsibilities of decentralized platforms and where regulators should draw the line.

Notable Incidents Behind the Money Trail

DCENT Wallet Exploit (September 2026)

The DCENT breach drained roughly $20 million across 6,678 wallets holding assets such as Bitcoin, Ethereum, XRP, Tron, and various EVM tokens. A significant portion of the stolen funds was subsequently laundered through FreedomXMR.

Fetch.ai Exploit (September 2026)

Compromised private signing keys allowed an attacker to confiscate 8.7 million FET tokens (≈$1.5 million). The perpetrator then minted unauthorized NuNet (NTX), SingularityNet (AGIX), and World Mobile Token (WMTx) assets, inflating the total loss to about $2.25 million, a sum that moved through FreedomXMR.

Axelar Network Exploit (June 2026)

An “infinite mint” bug in an IBC‑enabled smart contract on Secret Network led to the loss of approximately $4.6 million in Axelar‑wrapped assets. The attacker redeemed the illicitly minted tokens for genuine assets held in escrow, again using FreedomXMR for conversion.

Gamdom Exploit (Recent)

This month’s Gamdom breach drained around $4.2 million from the gaming platform’s hot wallets, affecting tokens on Ethereum, Solana, BNB Chain, Tron, and XRP Ledger. The compromised assets were subsequently moved onto FreedomXMR.

Unnamed Ransomware Payment

ZachXBT also traced a sizable transaction to an unnamed ransomware payment that occurred last month, further underscoring the platform’s role in facilitating illicit fund flows.

Liquidity sourced from KuCoin

The investigation uncovered a connection to KuCoin, a centralized exchange, noting that more than 3,000 deposits of Monero (XMR) originated from KuCoin users. The flow mirrors the swap model employed by Wagyu, a private Monero exchange, suggesting a coordinated laundering technique.

These revelations have intensified calls for tighter oversight of permissionless exchanges and prompted regulators to reconsider how they classify and police decentralized trading venues.

Source link