ZachXBT chased after over $20 million, Hyperliquid's' unlicensed ', who took advantage of it? On October 20th, ZachXBT publicly announced that a centralized service called FreedomXMR (FXMR) appeared on Hyperliquid Core in August this year. According to his investigation conclusion, over 87% of the deposit amount for this service is directly related to illegal activities FXMR obtained token identification through Hyperliquid auction on July 27th and paid 518.28 HYPE, which was approximately $28000 at the time He manually reviewed a single historical deposit exceeding $10000 and recovered over $20 million in funds related to vulnerability attacks, ransomware, malware, and social engineering attacks, involving DCENT Wallet http://Fetch.ai 、 Axelar and Gamdom events First, look at the source DCENT Wallet occurred in September http://Fetch.ai The Axelar attack and a ransom payment without disclosing the specific victim; In October, funds related to Gamdom attacks appeared again These four named attacks, as well as an unnamed ransom payment, span across September and October. The starting points of different cases are not the same, and the addresses and asset conversions passed through are not exactly the same. However, the multiple paths in the figure ultimately converge to the same marked FXMR hot money package 0x5168... def2 Looking at 87% again According to statistical standards, for every $100 deposit, more than $87 is associated with illegal activities, and the remaining less than 13% cannot be directly referred to as "legal funds". It can only be said that it has not been included in the direct association scope mentioned in the original post The investigation did not stop at the hot wallet. He also released three wallets marked as administrators and pointed out that the operator obtained XMR liquidity from KuCoin and made more than 3000 deposits to the exchange through associated addresses Putting the timeline together makes the speed of scale expansion more intuitive On July 27th, FXMR obtained the token identifier through auction and paid 518.28 HYPE, which was approximately $28000 at the time In August, services reportedly began to appear From September to October, multiple attacks and extortion related funds listed in the investigation entered its tracking range On October 20th, the investigation was made public From bidding to disclosure, there is a gap of about 85 days; From the appearance of the service to disclosure, it has been less than three months In such a short window, more than $20 million in related funds have been traced back Putting these data back into the same graph, we can see three different layers of information Exceeding $20 million indicates the scale of funds that have been traced back More than 87%, indicating the structure of the funding source identified by the investigator More than 3000 exchange recharges, as well as the connection between the hot wallet and the administrator's address, provide clues for continuing to verify the service operation relationship They are not the same indicator, but together they have consolidated the survey subjects from scattered transfers to a set of wallets and fund connections that can continue to be tracked Currently, ZachXBT has stated that the source data table has been handed over to the Hyperliquid team Unlicensed deployment solves the threshold for entering the market, but when the same set of open infrastructure is maliciously exploited, how can the facts and responsibilities be clarified Perhaps it is what Hyperliquid will face HYPE Hyperliquid ZachXBT