# Ledger / CryptoBillis drain tracker

Live, read-only tracker of the Oct 2026 theft from Ledger users who bought devices through the reseller CryptoBillis.
Updated every minute from BTC, Ethereum and TRON. Labels from MistTrack (SlowMist) and Arkham.

Snapshot (2026-10-09T21:30:04.000Z):
- stolen from victims: $85,275,577 across 406 victim wallets (btc $17677656, eth $3633798, tron $63964122)
- still in attacker-controlled wallets: $65,658,235 in 218 wallets
- frozen by Tether: $10,000,001 (31 wallets)
- moved into bridges / exchanges: $53,361,784

JSON API (CORS open):
- https://localhost:8080/api/stats            headline numbers, parked wallets, cash-out venues
- https://localhost:8080/api/feed?since=<id>  movement events, newest first
- https://localhost:8080/api/stream           server-sent events, live
- https://localhost:8080/api/addresses?role=attacker|peel|service|victim
- https://localhost:8080/api/address/<addr>   one wallet + its transfers
- https://localhost:8080/api/path/<addr>  evidence path from a theft address to a wallet
- https://localhost:8080/api/freeze-targets  attacker wallets holding stablecoins right now
- https://localhost:8080/api/export/{addresses,exchange-deposits,victims}[?format=csv]  bulk exports

Roles: attacker = disclosed theft address; peel = attacker-controlled hop; service = labelled bridge/exchange/DEX that received funds (not the attacker); victim = drained wallet.