ZachXBT identifies over $20M in illicit funds routed to Monero swap service FreedomXMR

On October 20, 2026, specialized investigator ZachXBT revealed that over $20 million from illicit activities were routed to FreedomXMR, a Monero (XMR) swap service operating on Hyperliquid Core. This discovery highlights the risks of money laundering via anonymous protocols, as European regulators tighten their surveillance under the MiCA regulation. Context ZachXBT, a recognized figure in the analysis of illicit financial flows in crypto-assets, published an investigation detailing the transfer of suspicious funds to FreedomXMR (FXMR), a swap service allowing the conversion of assets such as USDC into Monero (XMR), a cryptocurrency renowned for its opacity. This protocol relies on Hyperliquid Core, a decentralized infrastructure offering fast and low-cost transactions, but without anti-money laundering (AML) compliance mechanisms or identity verification (KYC). Monero, ranked as the 13th most followed asset on CoinGecko as of October 23, 2026, is often preferred for its anonymity, making it an attractive tool for malicious actors. Simultaneously, the European Union adopted the MiCA regulation in 2024, imposing strict obligations on crypto-asset platforms, but excluding unregulated services like FreedomXMR. This case occurs in a context of increased distrust toward decentralized protocols, as illicit crypto-asset transaction volumes reached $3.5 billion in 2025, according to Chainalysis. The Facts According to ZachXBT's report, published by NFT Evening on October 20, 2026, over $20 million from cyberattacks and illicit activities passed through FreedomXMR between July and September 2026. The funds were identified via two wallet addresses on the BNB Chain network: 0x4b…d3e (entry) and 0x9f…a7b (exit). Data from CryptoScore Pro, as of October 23, 2026, provides no information on FreedomXMR, but confirms Monero's (XMR) position as the 13th most followed asset on CoinGecko, with an undisclosed market capitalization. Here are the key elements of the investigation: The service uses Hyperliquid Core to execute swaps, with reduced fees and latency of less than 5 seconds, according to statements by ZachXBT. No public audit has been conducted on FreedomXMR, and the protocol operates outside the MiCA regulatory framework, without KYC/AML measures. Illicit funds reportedly come from various sources, including platform hacks and scams, but their exact origin has not been fully confirmed. Markets are reacting with caution: the price of XMR, stable around 150 dollars as of October 23, 2026, has not yet undergone a significant correction, despite fears of increased surveillance. European regulators, already on alert, could announce measures by the end of November 2026, although nothing has been officialized yet. Understanding Key Concepts Atomic Swap An atomic swap is a decentralized transaction allowing the exchange of two crypto-assets without an intermediary, via a smart contract. For example, a user can convert USDC to Monero (XMR) directly on FreedomXMR, without going through a regulated platform. This mechanism relies on protocols like Hyperliquid Core, which guarantee the simultaneous execution of both parts of the transaction, or its cancellation in case of failure. The main advantage is speed and reduced fees, but the lack of control exposes users to money laundering risks. Hyperliquid Core Hyperliquid Core is a decentralized infrastructure designed to facilitate crypto-asset exchanges with minimal latency and reduced costs. Unlike centralized platforms like Binance or Coinbase, it does not store user funds and does not require identity verification. FreedomXMR uses it to execute its swaps, benefiting from its speed (less than 5 seconds per transaction) and anonymity. However, this decentralization also limits recourse in case of fraud or loss of funds. MiCA (Markets in Crypto-Assets) The MiCA regulation, which entered into force in 2024 in the European Union, frames services related to crypto-assets to combat money laundering and protect investors. It imposes transparency obligations, such as identity verification (KYC) and the reporting of suspicious transactions (AML), on regulated platforms. However, decentralized protocols like FreedomXMR, which have no identifiable legal entity, escape these rules. This regulatory loophole explains why anonymous services remain attractive for illicit activities. Analysis: what is at stake The influx of 20 million dollars of illicit funds toward FreedomXMR reveals economic and financial mechanisms specific to anonymous assets. On one hand, demand for Monero (XMR) is increasing due to its opacity, temporarily strengthening its liquidity and price. According to CoinGecko data as of October 23, 2026, XMR remains the 13th most followed asset, suggesting structural resilience despite regulatory risks. On the other hand, Hyperliquid Core, as a settlement layer, reduces transaction costs and accelerates flows, creating a windfall effect for malicious actors. These incentives could, however, backfire on the sector: increased surveillance by regulators, as provided for by MiCA, could fragment liquidity by excluding non-compliant services. For investors, the media exposure of these illicit flows introduces a risk premium on XMR, likely to weigh on its valuation in the short term. Competitors of FreedomXMR, such as regulated DEXs or platforms integrating KYC protocols, could benefit, capturing a portion of the volumes. Several scenarios are emerging: targeted regulation on anonymous swaps, a drop in volumes on non-audited services, or an adaptation of illicit actors toward even more opaque solutions. None of these hypotheses can be prioritized at this stage, due to a lack of consolidated data on past market reactions to similar episodes. Risks and Uncertainties Several gray areas persist. First, ZachXBT's analysis relies on specific wallet addresses (0x4b…d3e and 0x9f…a7b), the accuracy of which has not been verified by third parties. If these addresses were…