Forty-four windows, read one by one

Automatic pass over the ledger on 11 October 2026. A label is a reading aid, not a verdict, and nothing on this page is in the incident log. The rule itself (slowDrainsDominant) is a candidate under measurement, not a live detector; its synthetic record is in the generator repository.

What a window is

The candidate rule asks, for every agent and every payee it had never paid before: did the agent, within 72 hours of that first payment, pay this new address at least $250, at least five times its previous largest payment, in two or more payments of varying size, and did that address take at least 80% of everything the agent paid in those 72 hours? Each row in the table below is one such window. Four signals were then read from the ledger for each: how many agents ever paid the payee, whether the payee is a contract or a plain address (EOA), how many counted payments the agent made to anyone else after the window, and the date of its last payment. The label follows from them.

The two drain candidates, read at receipt level

For both, the payee's own stablecoin movements in the 48 hours after the last payment were read from the chain on 11 October (Transfer logs of USDC and USDT, the payee's code and balance, the agent wallet's balance).

Reading. Both have the shape of a withdrawal through a fresh deposit address into a high-throughput venue: a test amount, the full amount minutes later, everything forwarded at once, silence after. That is what a person cashing out through an exchange deposit address looks like, and it is also what a careful thief does with a stolen key. The chain does not say which. So the rule this reading feeds is not a theft detector. Its honest name is drain, wallet abandoned: the wallet was emptied to a fresh address and the operator never came back. It catches exits, legitimate or not, and must be worded that way wherever it is published.

What the two cases add to the queue: the second-hop addresses, a contract paid by 106 agents and a hot wallet moving $69M in two days, are unlabelled in our book. Naming the venues (from public explorer tags, not guesses) would turn "a high-throughput venue" into a fact, and that enrichment is next.