A centralized swap service called FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026, and an on-chain review of its inflows found that more than 87% of its volume is tied directly to illicit activity.

A manual check of every historical FXMR inflow above $10K traced over $20M to ransomware, exploits, malware and social engineering cases.

The traced funds include proceeds from the DCENT Wallet, Fetch.ai and Axelar exploits in September 2026, an unnamed ransomware payment and the Gamdom exploit in October. The service converts deposits into Monero, with the admin sourcing XMR liquidity from KuCoin through 3K+ deposits. The FXMR ticker was bought in a Hyperliquid auction on July 27, 2026 for 518.28 HYPE (about $28K).

HL Core has previously been used by other centralized laundering services such as b1exch, which exploit the chain's permissionless design. A spreadsheet with the source data has been shared with the Hyperliquid team.