What makes withdrawals abnormal
Cexlens scores each exchange as a whole over a rolling 15-minute window and looks at each receiving wallet that has no exchange, fund, market maker or protocol label. Size alone never opens an incident: a large exchange routinely sends hundreds of millions to one of its own unlabeled wallets. A receiving wallet becomes suspect when it got at least $50M and shows a sign of a drain: the wallet is new (its first activity is within the last 48 hours), five or more assets reached it (a sweep), it was fed from several exchange wallets or chains, or mixer money is involved (the wallet, or whoever signed the transaction that moved the exchange's funds, was funded through a mixer such as Tornado Cash). An old wallet also has to be unusually large for that exchange: at least twice the 99th percentile of the biggest single receiver in a 15-minute window over the last 7 days. Every number here is an operator setting and can change.
- Suspected At least one receiving wallet is suspect.
- Escalated Mixer money involved, or at least $250M across two or more chains or with three signs at once.
- Confirmed Set by an operator after the exchange confirms. Only then does the card say drain.
Read the evidence page
The page opens with the total, the number of transfers, chains and receiving wallets, and a clock: first transfer, the moment Cexlens flagged it and the last transfer, in UTC. Where the money went draws each exchange wallet to each receiving wallet with the ribbon width set by USD. By chain and asset sums amounts per coin. Every transfer lists each transfer with a link to its block explorer, so anyone can check it. After an incident opens, Cexlens also asks what each receiving wallet got from the same exchange on every chain it indexes, including transfers made inside a contract call, and adds them as they land.
What an incident does not prove
The chain shows transfers, not their cause. An incident does not say who controls the receiving wallets or how the transfers were authorised, and a large planned move to a new custody wallet can look the same until the exchange explains it. USD values use the price at the transfer where one exists. Funds on chains Cexlens does not index yet are missing from the totals. A reconstructed incident was rebuilt from the Cexlens archive after the fact and is labelled as such; it was not a live alert.
Frequently asked questions
Why is one incident one card and not one card per coin?
A drain moves many coins on many chains at once. One card per coin would bury the story under dozens of rows, so the incident groups them into one Story and the evidence page lists every transfer.
Does Cexlens call it a hack?
No. Until the exchange confirms, the wording is abnormal withdrawals and possible drain. Cexlens never names who is behind the transfers.