Over 87% of Funds in Hyperliquid Monero Service Flagged as Suspicious

A recent in-depth analysis by on-chain investigator ZachXBT has raised serious concerns about a mixing service on the Hyperliquid derivatives platform. The report indicates that a staggering portion of the funds flowing into the service, known as FXMR, are linked to illicit origins.

Millions Traced to Cybercrime Operations

ZachXBT's investigation focused on historical inflows exceeding $10,000 per transaction. The follow-the-money trail led to over $20 million that could be directly connected to several high-profile cyber incidents. These include:

  • Attacks on cryptocurrency projects like DCENT Wallet, Fetch.ai, and Axelar in September 2026.
  • The October 2026 breach of the Gamdom gambling platform.

The sources of funds involved ransomware, exploits, malware, and social engineering attacks.

Service Structure and Key Addresses Revealed

The report characterizes FXMR as a centralized laundering tool that emerged around August 2026. ZachXBT publicly identified the service's hot wallet and three addresses controlled by its administrators.

A central exchange was flagged as a primary liquidity source. The analysis uncovered more than 3,000 deposit transactions linked to the administrators' acquisition of Monero (XMR) through this venue.

The FXMR service code itself was reportedly obtained via a Dutch auction on Hyperliquid in late July for approximately $28,000.

Findings Reported, Action Awaited

ZachXBT confirmed he has shared the full set of on-chain data with the Hyperliquid team. As of now, there is no public information suggesting the protocol has taken enforcement actions such as freezing or restricting the implicated accounts.

It is crucial to contextualize the findings. The $20 million figure represents only the portion of transactions above the $10k threshold that were traced to known criminal events, not the service's total volume. Furthermore, the use of privacy-enhancing assets like Monero does not in itself constitute evidence of wrongdoing, and the referenced exchange transfers do not prove the exchange's knowledge or involvement.