{"investigation":{"slug":"freedomxmr","entity_name":"FreedomXMR","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":0.3,"status":"published","content_type":"investigation","summary":"FreedomXMR (ticker FXMR) is an alleged centralized Monero (XMR) swap/laundering service said to operate on Hyperliquid Core since August 2026. The sole source for its existence and conduct, a 2026-10-20 Telegram post by blockchain investigator ZachXBT, alleges that over 87% of its inflow volume above $10,000 traces to ransomware, exploit, malware, and social-engineering theft proceeds, including funds from several independently confirmed 2026 hacks. As of this writing no court filing, regulator, or mainstream news outlet has corroborated FreedomXMR's existence, its wallet addresses, or the laundering allegations, so this page should be treated as a preliminary, low-confidence flag rather than a verified finding.","sections":[{"content":"According to a Telegram post by the pseudonymous blockchain investigator ZachXBT, published 2026-10-20, FreedomXMR is a centralized Monero (XMR) laundering service that began operating on Hyperliquid Core in August 2026. ZachXBT alleges that more than 87% of FreedomXMR's inflow volume is tied to illicit activity, and states that a manual review of all inflows above $10,000 traced more than $20 million directly to proceeds of ransomware, exploits, malware, and social-engineering thefts. ZachXBT reports having shared a spreadsheet of supporting source data with the Hyperliquid team. These are allegations from a single investigator's social media post; AVOID.NET was unable to independently verify the underlying inflow data, as Hyperliquid's own block explorer (Hypurrscan) returned no readable transaction data for the cited addresses during this review, and no other outlet has yet published independent analysis of FreedomXMR.","heading":"Allegation of operation as a laundering service","sources":[{"url":"https://t.me/zachxbt/367","name":"ZachXBT, Investigations channel, Telegram post #367","type":"social_media","credibility":3},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"ZachXBT (Wikipedia biographical background, for investigator credibility context)","type":"other","credibility":2}],"severity":"critical"},{"content":"ZachXBT's post names five sources of allegedly laundered funds: the D'CENT hardware/app wallet exploit, a Fetch.ai exploit, an Axelar exploit, an unnamed ransomware payment, and the Gamdom exploit. Independent reporting confirms three of these underlying incidents occurred in 2026, though with some discrepancies from the dates given in the ZachXBT post. The D'CENT App Wallet was drained of XRP beginning around September 15-16, 2026, with news estimates of losses ranging from roughly $2.8 million to close to $20 million across thousands of wallets. A Fetch.ai-linked token converter exploit on Ethereum, reported around September 19, 2026, saw an attacker withdraw roughly $1.5-2.25 million in realized value, with knock-on unauthorized token minting affecting NuNet and SingularityNET. Gamdom, a crypto casino, was hacked on October 13, 2026, with reported losses of roughly $3-4.3 million across multiple chains. An Axelar bridge exploit tied to Secret Network did occur in 2026, but independent reporting dates it to June 10, 2026 (loss of approximately $4.67 million), not September 2026 as stated in the ZachXBT post; this is a discrepancy AVOID.NET could not resolve, and it is possible either the post's date is imprecise or a separate, unreported September incident involving Axelar exists. No independent source confirms that proceeds from any of these five incidents actually flowed into FreedomXMR specifically; that link rests solely on ZachXBT's unverified on-chain tracing.","heading":"Alleged links to specific hacks and exploits","sources":[{"url":"https://blockhead.co/2026/09/23/dcent-app-wallet-flaw-linked-to-theft-of-millions-of-xrp","name":"D'CENT App Wallet flaw linked to theft of millions of XRP","type":"news_article","credibility":2},{"url":"https://www.bitrue.com/blog/dcent-wallet-hack-20m-xrp-stolen-6678-wallets","name":"D'CENT Wallet Hack: Nearly $20M in XRP Stolen From 6,678 Wallets","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/blog/ae-fetch-ai-fet-exploit-1-56m-drained-from-token-converter-after-signing-key-compromise","name":"Fetch.ai (FET) Exploit: $1.56M Drained From Token Converter After Signing Key Compromise","type":"news_article","credibility":2},{"url":"https://forklog.com/en/analysts-link-fetch-ai-nunet-and-singularitynet-attacks-to-single-hacker/","name":"Analysts link Fetch.ai, NuNet and SingularityNET attacks to single hacker","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/405459/secret-networks-axelar-bridge-drained-for-4-67-million-in-infinite-mint-exploit-that-went-unnoticed-for-seven-days","name":"Secret Network's Axelar bridge drained for $4.67 million in infinite-mint exploit that went unnoticed for seven days","type":"news_article","credibility":1},{"url":"https://www.kucoin.com/news/flash/axelar-network-loses-4-7m-in-bridge-exploit-linked-to-secret-network","name":"Axelar Network Loses $4.7M in Bridge Exploit Linked to Secret Network","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/gamdom-hacked-for-42-million-across-multiple-chains-following-server-breach-99931","name":"Gamdom hacked for $42 million across multiple chains following server breach (headline figure disputed; see body copy for revised estimates)","type":"news_article","credibility":2},{"url":"https://t.me/zachxbt/367","name":"ZachXBT, Investigations channel, Telegram post #367","type":"social_media","credibility":3}],"severity":"high"},{"content":"ZachXBT's post states that the FXMR ticker was purchased in a Hyperliquid spot-deployer auction on 2026-07-27 for 518.28 HYPE, worth approximately $28,000 at the time, and links the transaction via Hypurrscan, Hyperliquid's block explorer. The post names a hot wallet address (0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2 -- note this string is 41 characters after the 0x prefix in the source material provided to AVOID.NET and could not be confirmed as a valid, checksummed address) and three admin wallet addresses. AVOID.NET attempted to verify these addresses and the referenced Hypurrscan auction record directly but Hypurrscan's pages are JavaScript-rendered and did not return readable transaction data to an automated fetch; the addresses and the auction transaction are therefore unverified by this review. Separately, ZachXBT alleges the FreedomXMR admin sources XMR liquidity through more than 3,000 deposits to the exchange KuCoin, using a swap model the post describes as resembling that of Wagyu.xyz, a Monero liquidity venue that has publicly and legitimately marketed itself as routing XMR volume through Hyperliquid's on-chain order book since January 2026. The existence and legitimate operation of Wagyu.xyz is independently documented; its described resemblance to FreedomXMR's alleged model is ZachXBT's characterization only and is not independently verified.","heading":"Alleged ticker auction, wallets, and liquidity sourcing","sources":[{"url":"https://t.me/zachxbt/367","name":"ZachXBT, Investigations channel, Telegram post #367","type":"social_media","credibility":3},{"url":"https://decrypt.co/375636/wagyu-xyz-reaches-700m-in-monero-volume-and-launches-public-api-for-pre-execution-compliance-routing","name":"Wagyu.xyz Reaches $700M in Monero Volume and Launches Public API for Pre-Execution Compliance Routing","type":"news_article","credibility":2}],"severity":"medium"},{"content":"ZachXBT's post refers to a prior, similarly structured centralized laundering service, b1exch, which the post says also operated on Hyperliquid Core. The post does not provide wallet addresses, volume figures, or dates for b1exch, and AVOID.NET's own web searches found no independent reporting, on-chain analysis, or other reference to an entity by that name. This claim is included here only for context on the pattern ZachXBT describes and should be treated as unverified.","heading":"Alleged prior precedent: b1exch","sources":[{"url":"https://t.me/zachxbt/367","name":"ZachXBT, Investigations channel, Telegram post #367","type":"social_media","credibility":3}],"severity":"low"},{"content":"As of 2026-10-21, AVOID.NET found no coverage of FreedomXMR or the FXMR ticker in mainstream or crypto-focused news outlets (including outlets that have covered related Hyperliquid and Monero-laundering stories in the same period), no regulatory or law-enforcement action referencing the name, and no independently retrievable on-chain data corroborating the specific wallet addresses or auction transaction cited in the source post. The underlying pattern described, that Hyperliquid's permissionless ticker-auction and spot-deployment system can be used to stand up Monero conversion services that attract illicit funds, is consistent with documented features of Hyperliquid (its HIP-1/HIP-3 ticker auctions and spot markets) and with ZachXBT's established track record of tracing stolen funds into Monero in prior, independently reported cases. That track record lends some credibility to the allegation, but it does not substitute for independent confirmation of FreedomXMR specifically.","heading":"Lack of independent verification","sources":[{"url":"https://t.me/zachxbt/367","name":"ZachXBT, Investigations channel, Telegram post #367","type":"social_media","credibility":3},{"url":"https://www.theblock.co/post/386014/monero-hit-all-time-high-this-week-crypto-sleuth-zachxbt-thinks-he-knows-why","name":"Monero hit an all-time high earlier this week, and crypto sleuth ZachXBT thinks he knows why","type":"news_article","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2026-07-27","event":"FXMR ticker allegedly purchased in a Hyperliquid spot-deployer auction for 518.28 HYPE (~$28,000), per ZachXBT.","source":"ZachXBT Telegram post #367","source_url":"https://t.me/zachxbt/367","date_evidence":"The FXMR ticker was bought in a Hyperliquid auction on July 27, 2026, for 518.28 HYPE (about $28K)."},{"date":"2026-08","event":"FreedomXMR allegedly began operating as a centralized Monero laundering service on Hyperliquid Core.","source":"ZachXBT Telegram post #367","source_url":"https://t.me/zachxbt/367"},{"date":"2026-09","event":"D'CENT App Wallet exploit occurs, draining XRP from thousands of wallets; later alleged by ZachXBT to be a source of funds inflowing to FreedomXMR.","source":"Blockhead / Bitrue coverage of D'CENT hack","source_url":"https://blockhead.co/2026/09/23/dcent-app-wallet-flaw-linked-to-theft-of-millions-of-xrp"},{"date":"2026-09","event":"Fetch.ai-linked token converter exploit occurs on Ethereum; later alleged by ZachXBT to be a source of funds inflowing to FreedomXMR.","source":"KuCoin / Forklog coverage of Fetch.ai exploit","source_url":"https://www.kucoin.com/blog/ae-fetch-ai-fet-exploit-1-56m-drained-from-token-converter-after-signing-key-compromise"},{"date":"2026-06-10","event":"Axelar bridge/Secret Network infinite-mint exploit occurs (independently dated to June, not September as stated in the ZachXBT post); later alleged by ZachXBT to be a source of funds inflowing to FreedomXMR.","source":"The Block coverage of Axelar-Secret Network exploit","source_url":"https://www.theblock.co/post/405459/secret-networks-axelar-bridge-drained-for-4-67-million-in-infinite-mint-exploit-that-went-unnoticed-for-seven-days","date_evidence":"The attack happened on June 10, 2026, and went undetected for seven days until a failed transfer on June 17 revealed the problem."},{"date":"2026-10","event":"Gamdom, a crypto casino, is hacked for an estimated $3-4.3 million across multiple chains; later alleged by ZachXBT to be a source of funds inflowing to FreedomXMR.","source":"Phemex coverage of Gamdom hack","source_url":"https://phemex.com/news/article/gamdom-hacked-for-42-million-across-multiple-chains-following-server-breach-99931","date_original":"2026-10-13"},{"date":"2026-10","event":"ZachXBT publishes a Telegram post naming FreedomXMR (FXMR) as a centralized Monero laundering service on Hyperliquid Core, alleging over 87% of its inflow volume above $10,000 ties to illicit activity, and naming wallet addresses and a prior similar service, b1exch.","source":"ZachXBT Telegram post #367","source_url":"https://t.me/zachxbt/367","date_original":"2026-10-20"}],"sources_used":[{"url":"https://t.me/zachxbt/367","name":"ZachXBT, Investigations channel, Telegram post #367","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"ZachXBT (Wikipedia)","type":"other","archive_url":"http://web.archive.org/web/20261021092543/https://en.wikipedia.org/wiki/ZachXBT","credibility":2,"archive_timestamp":"2026-10-21T09:25:43+00:00"},{"url":"https://blockhead.co/2026/09/23/dcent-app-wallet-flaw-linked-to-theft-of-millions-of-xrp","name":"D'CENT App Wallet flaw linked to theft of millions of XRP","type":"news_article","archive_url":"http://web.archive.org/web/20261021092601/https://www.blockhead.co/2026/09/23/dcent-app-wallet-flaw-linked-to-theft-of-millions-of-xrp/","credibility":2,"archive_timestamp":"2026-10-21T09:26:01+00:00"},{"url":"https://www.bitrue.com/blog/dcent-wallet-hack-20m-xrp-stolen-6678-wallets","name":"D'CENT Wallet Hack: Nearly $20M in XRP Stolen From 6,678 Wallets","type":"news_article","archive_url":"http://web.archive.org/web/20261021092622/https://www.bitrue.com/blog/dcent-wallet-hack-20m-xrp-stolen-6678-wallets","credibility":2,"archive_timestamp":"2026-10-21T09:26:22+00:00"},{"url":"https://www.kucoin.com/blog/ae-fetch-ai-fet-exploit-1-56m-drained-from-token-converter-after-signing-key-compromise","name":"Fetch.ai (FET) Exploit: $1.56M Drained From Token Converter After Signing Key Compromise","type":"news_article","archive_url":"http://web.archive.org/web/20261021092824/https://www.kucoin.com/blog/ae-fetch-ai-fet-exploit-1-56m-drained-from-token-converter-after-signing-key-compromise","credibility":2,"archive_timestamp":"2026-10-21T09:28:24+00:00"},{"url":"https://forklog.com/en/analysts-link-fetch-ai-nunet-and-singularitynet-attacks-to-single-hacker/","name":"Analysts link Fetch.ai, NuNet and SingularityNET attacks to single hacker","type":"news_article","archive_url":"http://web.archive.org/web/20261021092641/https://forklog.com/en/analysts-link-fetch-ai-nunet-and-singularitynet-attacks-to-single-hacker/","credibility":2,"archive_timestamp":"2026-10-21T09:26:41+00:00"},{"url":"https://www.theblock.co/post/405459/secret-networks-axelar-bridge-drained-for-4-67-million-in-infinite-mint-exploit-that-went-unnoticed-for-seven-days","name":"Secret Network's Axelar bridge drained for $4.67 million in infinite-mint exploit that went unnoticed for seven days","type":"news_article","archive_url":"http://web.archive.org/web/20260802185509/https://www.theblock.co/post/405459/secret-networks-axelar-bridge-drained-for-4-67-million-in-infinite-mint-exploit-that-went-unnoticed-for-seven-days","credibility":1,"archive_timestamp":"2026-08-02T18:55:09+00:00"},{"url":"https://www.kucoin.com/news/flash/axelar-network-loses-4-7m-in-bridge-exploit-linked-to-secret-network","name":"Axelar Network Loses $4.7M in Bridge Exploit Linked to Secret Network","type":"news_article","archive_url":"http://web.archive.org/web/20261021092158/https://www.kucoin.com/news/flash/axelar-network-loses-4-7m-in-bridge-exploit-linked-to-secret-network","credibility":2,"archive_timestamp":"2026-10-21T09:21:58+00:00"},{"url":"https://phemex.com/news/article/gamdom-hacked-for-42-million-across-multiple-chains-following-server-breach-99931","name":"Gamdom hacked for $42 million across multiple chains following server breach","type":"news_article","archive_url":"http://web.archive.org/web/20261021055937/https://phemex.com/news/article/gamdom-hacked-for-42-million-across-multiple-chains-following-server-breach-99931","credibility":2,"archive_timestamp":"2026-10-21T05:59:37+00:00"},{"url":"https://decrypt.co/375636/wagyu-xyz-reaches-700m-in-monero-volume-and-launches-public-api-for-pre-execution-compliance-routing","name":"Wagyu.xyz Reaches $700M in Monero Volume and Launches Public API for Pre-Execution Compliance Routing","type":"news_article","archive_url":"http://web.archive.org/web/20261021091929/https://decrypt.co/375636/wagyu-xyz-reaches-700m-in-monero-volume-and-launches-public-api-for-pre-execution-compliance-routing","credibility":2,"archive_timestamp":"2026-10-21T09:19:29+00:00"},{"url":"https://www.theblock.co/post/386014/monero-hit-all-time-high-this-week-crypto-sleuth-zachxbt-thinks-he-knows-why","name":"Monero hit an all-time high earlier this week, and crypto sleuth ZachXBT thinks he knows why","type":"news_article","archive_url":"http://web.archive.org/web/20260117032151/https://www.theblock.co/post/386014/monero-hit-all-time-high-this-week-crypto-sleuth-zachxbt-thinks-he-knows-why","credibility":1,"archive_timestamp":"2026-01-17T03:21:51+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-21T04:15:30.534181+00:00","updated_at":"2026-10-21T21:04:21.144451+00:00"},"source_quality":{"total":11,"tier1":1,"tier2":3,"tier3":0,"unrated":7},"follower_count":null,"content_updated_at":"2026-10-21T04:15:30.877Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}