MistTrack: "CryptoBillis Ledger Drainer" addresses move 2,000.2 ETH into Tornado Cash
MistTrack reported on 29 October 2026 that addresses it links to a "CryptoBillis Ledger Drainer" moved 2,000.2 ETH into Tornado Cash.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Blockchain anti-money-laundering tracker MistTrack (by SlowMist) said on X on 29 October 2026 that the "CryptoBillis Ledger Drainer" had just transferred 2,000.2 ETH into the Tornado Cash mixer. MistTrack listed two Ethereum addresses: 0x7e6b9f774a5897e55c0414c892b0df27e261b187 and 0x6af01abcb12a2c885dbfa3eb002c83e1b059a3c3. The name "CryptoBillis Ledger Drainer" is MistTrack's label for the case; the post does not identify any person or company behind it.
How the scam works
A wallet drainer is a malicious kit, usually behind a fake website or approval prompt, that tricks victims into signing a transaction or approval that lets the attacker sweep their tokens. The stolen assets are then gathered in a few addresses and, as here, often pushed through a mixing service to cut the trail to the original victims. MistTrack's post is a fund-tracking update: it reports that the addresses linked to this drainer have moved 2,000.2 ETH into Tornado Cash. It also quotes an earlier MistTrack update, dated 10 October, which said a related address (0x83aeaC166f6832aE3500000a24510a95a052A599) had moved about 463 ETH into the mixer, and it links to a MistTrack investigation page for the case.
The post does not say how the drainer works, how many victims there were or how much was lost in total. Despite "Ledger" in the label, it does not state that the hardware-wallet maker Ledger is involved or that any of its devices were compromised. The addresses are listed so that exchanges, wallets and investigators can watch for them.
Source
MistTrack (@MistTrack_io) post on X, 29 October 2026, and its earlier post of 10 October 2026 on the same case.
Red flags
- A site or pop-up that asks you to connect a wallet and sign an unfamiliar approval to "verify", "claim" or "sync".
- Signing a transaction you cannot read on your hardware wallet's screen.
- Funds leaving a wallet right after an approval you did not expect.
- Addresses 0x7e6b...b187 or 0x6af0...a3c3 appearing in your transaction history.
- Support or "recovery" messages offering to fix a drained wallet for a fee.
If you were targeted
- 1Do not interact with or send funds to the two addresses listed; exchanges can use them to screen deposits.
- 2Review and revoke token approvals for your wallet with a trusted tool if you signed something unexpected.
- 3Only use the official website or app address for your wallet maker, and never enter your recovery phrase online.
- 4If you were drained, move remaining assets to a new wallet, keep transaction hashes and report to police.
- 5Be wary of "recovery services" that contact you after a theft.