@lookonchain and @crypto_banter report the CryptoBilis Ledger Drainer deposited another 885 ETH (~$2.14M) into Tornado Cash. Pattern cited above $23M since late October per @arkham data. That is a Bigger Picture / on-chain security item with named monitors — not a PulseChain protocol failure, and not a reason to invent local whale prints that did not clear our list.
Hardware-wallet drainers matter to every chain’s users because the attack surface is the seed phrase and the device trust model, not the destination network alone. When named monitors keep printing Tornado Cash deposits from a labeled drainer cluster, the practical reader takeaway is operational: verify addresses, slow down signing, and treat unsolicited support channels as hostile.
Pulse-native monitoring in the same window stayed separate. PulseChain bridge: $158.6K inflows vs $297.2K outflows, net outflow $138.7K. HEX buys $23.0K across 52 transactions. Those figures are Pulse Paperboy bridge and core-activity monitoring. They are printed because they cleared desk rules — not because they are causally tied to the CryptoBilis cluster.
How to read this piece:
• CryptoBilis / Tornado Cash: attributed security monitoring from named outlets • Pulse bridge net outflow: local liquidity print for the same session • HEX buys $23.0K / 52 txs: listed core activity, not a single Whale Watch ticket by itself • Do not collapse global drainer news into a Pulse “hack” narrative without evidence
Security stories move faster than confirmations. Pulse Paperboy will keep the attribution chain intact: who reported, what was reported, what remains local and confirmed. Readers who want drama can find it on the timeline. Readers who want a newspaper get the sourced version.