API & MCP

The whole hackscan dataset, free and read-only: a REST API for your code, an MCP server for your AI agent. No key, no signup.

├─ base_url: hackscan.fun/api/v1
├─ auth: none
├─ rate_limit: 60/min per IP
├─ format: json, snake_case
└─ mcp: /mcp (streamable http)

Quickstart

Every endpoint is a plain GET that returns JSON. Amounts are USD at the time of the hack, dates are UTC, ids are stable slugs.

shell

curl 'https://hackscan.fun/api/v1/hacks?group=dprk&sort=amount&limit=5'

Building an agent? Skip the HTTP and plug the MCP server straight into Claude, Cursor or any MCP client.

Endpoints

GET/hacks

Filter and page through every hack. Combine any parameters.

Parameter	Type	Default	Description
group	all \| cex \| defi \| bridge \| wallet \| dprk	all	all, cex (exchanges), defi, bridge, wallet (wallets and private keys), dprk (North Korea)
q	string		Text in the name, technique or target
year	integer		Exact year
year_from	integer		From this year
year_to	integer		Up to this year
chain	string		Exact chain name, e.g. Ethereum, BSC, Solana
country	string		Victim headquarters country, e.g. Singapore
attacker	string		Attacker name (partial match), or 'any' for every attributed hack
classification	string		Attack class, e.g. Key Compromise
min_amount	number		Minimum USD stolen
sort	date \| amount \| returned	date	Sort field
order	desc \| asc	desc	desc or asc
limit	integer	50	Page size
offset	integer	0	Rows to skip

request

curl 'https://hackscan.fun/api/v1/hacks?group=dprk&sort=amount&limit=2'

response · live

{
  "total": 47,
  "total_stolen_usd": 5240130000,
  "offset": 0,
  "limit": 2,
  "hacks": [
    {
      "id": "bybit-2025-02-21",
      "name": "Bybit",
      "date": "2025-02-21",
      "amount_usd": 1400000000,
      "returned_usd": 1400000000,
      "chains": [
        "Ethereum"
      ],
      "target": "CEX",
      "classification": "Social Engineering",
      "technique": "Signer Phishing",
      "country": "Singapore",
      "attacker": "Lazarus Group",
      "attacker_country": "North Korea",
      "attribution": "confirmed",
      "attacker_wallets": 80,
      "zachxbt_posts": 6,
      "url": "https://hackscan.fun/h/bybit-2025-02-21"
    },
    {
      "id": "ronin-bridge-2022-03-23",
      "name": "Ronin Bridge",
      "date": "2022-03-23",
      "amount_usd": 624000000,
      "returned_usd": 0,
      "chains": [
        "Ethereum"
      ],
      "target": "DeFi Protocol",
      "classification": "Key Compromise",
      "technique": "Validator Key Compromised",
      "country": "Philippines",
      "attacker": "Lazarus Group",
      "attacker_country": "North Korea",
      "attribution": "confirmed",
      "attacker_wallets": 1,
      "zachxbt_posts": 0,
      "url": "https://hackscan.fun/h/ronin-bridge-2022-03-23"
    }
  ]
}

GET/hacks/{id}

One hack: the story, its location, every known attacker wallet with its source, and ZachXBT posts about it.

request

curl 'https://hackscan.fun/api/v1/hacks/bybit-2025-02-21'

response · live

{
  "id": "bybit-2025-02-21",
  "name": "Bybit",
  "date": "2025-02-21",
  "amount_usd": 1400000000,
  "returned_usd": 1400000000,
  "chains": [
    "Ethereum"
  ],
  "target": "CEX",
  "classification": "Social Engineering",
  "technique": "Signer Phishing",
  "country": "Singapore",
  "attacker": "Lazarus Group",
  "attacker_country": "North Korea",
  "attribution": "confirmed",
  "attacker_wallets": 80,
  "zachxbt_posts": 6,
  "url": "https://hackscan.fun/h/bybit-2025-02-21",
  "attribution_basis": "Bybit disclosed Lazarus Group phished DevOps engineer",
  "attribution_source": null,
  "city": "Singapore",
  "lat": 1.35735,
  "lng": 103.81984,
  "bridge": false,
  "description": "On February 21, 2025, Lazarus Group phished Bybit's DevOps engineer and spoofed the Safe UI to trick signers into blind-signing a masked transaction that deploy…",
  "source": "",
  "wallets": [
    {
      "address": "0x96221423681a6d52e184d440a8efcebb105c7242",
      "chain": "evm",
      "label": "attacker contract",
      "source": "https://www.nccgroup.com/research/in-depth-technical-analysis-of-the-bybit-hack"
    },
    {
      "address": "0x09278b36863be4ccd3d0c22d643e8062d7a11377",
      "chain": "evm",
      "label": "Etherscan label: Bybit Exploiter 33",
      "source": "https://etherscan.io/address/0x09278b36863be4ccd3d0c22d643e8062d7a11377"
    },
    /* … 78 more */
  ],
  "zachxbt": [
    {
      "date": "2025-03-18",
      "title": "Bybit hack exposes broken KYC/KYT systems",
      "summary": "The $1.4B DPRK laundering from a recent hack highlights flaws in KYC/KYT and the slow response of centralized exchanges.",
      "url": "https://t.me/investigations/234"
    },
    {
      "date": "2025-02-23",
      "title": "Bybit hack launderer traded Pump Fun meme coins",
      "summary": "An entity laundering Bybit hack funds also launched and traded Pump Fun meme coins, bridging USDC to Solana and BSC.",
      "url": "https://t.me/investigations/222"
    },
    /* … 4 more */
  ]
}

GET/address/{address}

Screen an EVM, Bitcoin, Tron or Solana address against hack wallets, ZachXBT theft addresses, phishing labels and OFAC sanctions. An empty list is not proof the address is safe.

request

curl 'https://hackscan.fun/api/v1/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c'

response · live

{
  "address": "0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c",
  "flagged": true,
  "hits": [
    {
      "kind": "hack",
      "name": "Binance CEX",
      "label": "receiving address",
      "source": "https://beincrypto.com/is-binance-being-hacked-customer-funds",
      "hack_id": "binance-cex-2026-10-29",
      "url": "https://hackscan.fun/h/binance-cex-2026-10-29"
    },
    {
      "kind": "hack",
      "name": "Coinbene",
      "label": "Main receiving wallet funded by Binance 14 hot wallet",
      "source": "https://socradar.io/blog/binance-hack-6-3b-hot-wallet-theft",
      "hack_id": "coinbene-2019-03-25",
      "url": "https://hackscan.fun/h/coinbene-2019-03-25"
    }
  ]
}

GET/investigations

ZachXBT's posts on hacks, thefts, scams and exchange alerts, newest first, with the theft addresses he names.

Parameter	Type	Default	Description
kind	all \| hack \| theft \| scam \| alert	all	hack, theft, scam or alert
q	string		Text in the name, technique or target
limit	integer	20	Page size
offset	integer	0	Rows to skip

request

curl 'https://hackscan.fun/api/v1/investigations?kind=hack&limit=1'

response · live

{
  "total": 51,
  "posts": [
    {
      "id": 371,
      "date": "2026-10-30",
      "kind": "hack",
      "title": "Arbitrum Freezes $30.5M from Binance Exploit",
      "summary": "Arbitrum Security Council froze ~$30.5M related to the Binance Exploit, utilizing specific transaction hashes and addresses.",
      "victim": "Binance",
      "amount_usd": 30500000,
      "attacker": null,
      "hack_id": "binance-cex-2026-10-29",
      "text": "BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.  \n\nExploiter address \n0x3E2bf1ac6bf0934BBba6456C341c2…",
      "url": "https://t.me/investigations/371",
      "theft_addresses": [
        "0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5"
      ]
    }
  ]
}

GET/stats

Totals and rankings: per year, chain, attack class, victim country and attacker, plus the 10 largest hacks.

request

curl 'https://hackscan.fun/api/v1/stats'

response · live

{
  "updated": "2026-11-01T23:39:16.000Z",
  "hacks": 1331,
  "stolen_usd": 27544813967.12813,
  "returned_usd": 2365644699.98,
  "attributed": 54,
  "by_year": [
    {
      "name": "2026",
      "hacks": 326,
      "stolen_usd": 8735550118.128132
    },
    {
      "name": "2025",
      "hacks": 148,
      "stolen_usd": 2715021619
    },
    /* … 14 more */
  ],
  "by_chain": [
    {
      "name": "Ethereum",
      "hacks": 551,
      "stolen_usd": 16441603268.548132
    },
    {
      "name": "Bitcoin",
      "hacks": 66,
      "stolen_usd": 11802588010
    },
    /* … 13 more */
  ],
  "by_classification": [
    {
      "name": "Key Compromise",
      "hacks": 163,
      "stolen_usd": 8964547383
    },
    {
      "name": "Frontend & Infrastructure",
      "hacks": 101,
      "stolen_usd": 7497616293
    },
    /* … 11 more */
  ],
  "by_country": [
    {
      "name": "Singapore",
      "hacks": 49,
      "stolen_usd": 8622691833
    },
    {
      "name": "China",
      "hacks": 30,
      "stolen_usd": 5573184400
    },
    /* … 13 more */
  ],
  "by_attacker": [
    {
      "name": "Lazarus Group",
      "hacks": 47,
      "stolen_usd": 5240130000
    },
    {
      "name": "SIM-swapping gang",
      "hacks": 1,
      "stolen_usd": 450000000
    },
    /* … 5 more */
  ],
  "largest": [
    {
      "id": "binance-cex-2026-10-29",
      "name": "Binance CEX",
      "date": "2026-10-29",
      "amount_usd": 6360000000,
      "returned_usd": 0,
      "chains": [
        "Ethereum",
        "Bitcoin",
        /* … 5 more */
      ],
      "target": "CEX",
      "classification": "Frontend & Infrastructure",
      "technique": "Key Leaked via Infrastructure",
      "country": "Singapore",
      "attacker": null,
      "attacker_country": null,
      "attribution": null,
      "attacker_wallets": 3,
      "zachxbt_posts": 1,
      "url": "https://hackscan.fun/h/binance-cex-2026-10-29"
    },
    {
      "id": "lubian-2020-12-28",
      "name": "LuBian",
      "date": "2020-12-28",
      "amount_usd": 3500000000,
      "returned_usd": 0,
      "chains": [
        "Bitcoin"
      ],
      "target": "Other",
      "classification": "Key Compromise",
      "technique": "Weak Key Generation",
      "country": "China",
      "attacker": null,
      "attacker_country": null,
      "attribution": null,
      "attacker_wallets": 0,
      "zachxbt_posts": 0,
      "url": "https://hackscan.fun/h/lubian-2020-12-28"
    },
    /* … 8 more */
  ],
  "sources": [
    "DefiLlama hacks",
    "Etherscan labels (eth-labels, Forta)",
    /* … 3 more */
  ]
}

Limits and errors

Rate limit: 60 requests per minute per IP, shared with the MCP endpoint. Over it: HTTP 429.
Caching: Responses carry Cache-Control (60 s for lists, 5 min for stats and addresses). Data refreshes every hour.
CORS: Open: call it from any website.
Errors: {"error":{"code":"bad_request","message":"…"}} with 400, 404, 429 or 500.
Need more?: Tell us what you are building.

MCP server

One URL, no key: https://hackscan.fun/mcp. Streamable HTTP, stateless, read-only tools.

Claude Code

shell

claude mcp add --transport http hackscan https://hackscan.fun/mcp

Claude Desktop and claude.ai

Settings → Connectors → Add custom connector → paste https://hackscan.fun/mcp.

Cursor, Windsurf and other clients

mcp.json

{
  "mcpServers": {
    "hackscan": {
      "url": "https://hackscan.fun/mcp"
    }
  }
}

Tools

search_hacksFilter the hackscan database of crypto hacks since 2011 (DefiLlama + attributions + attacker wallets). Returns matching hacks with amount stolen in USD, date, chains, technique, victim country and attacker when publicly attributed. group: cex = exchanges, bridge, wallet = private keys, dprk = North Korea / Lazarus. Sort by date, amount or returned.
get_hackFull record of one hack by id (from search_hacks): description, location, every known attacker wallet with its source, and ZachXBT posts about it.
check_addressCheck an EVM, Bitcoin, Tron or Solana address against attacker wallets from hacks, ZachXBT theft addresses, Etherscan phishing labels and the US OFAC sanctions list. No match is not proof the address is safe.
list_investigationsPosts by on-chain investigator ZachXBT about hacks, thefts, scams and exchange alerts, newest first, with the theft addresses he names and the hack each post is tied to.
get_statsTotals and rankings: stolen per year, per chain, per attack class, per victim country, per attacker, and the 10 largest hacks.

Raw JSON-RPC

shell

curl -s https://hackscan.fun/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_hacks","arguments":{"group":"cex","sort":"amount","limit":3}}}'

Try asking your agent: “Which exchanges lost the most to North Korea?”, “Is 0x… linked to a hack?”, “What did ZachXBT post this week?”

Code samples

javascript

const r = await fetch("https://hackscan.fun/api/v1/hacks?group=bridge&sort=amount&limit=10");
const { total, total_stolen_usd, hacks } = await r.json();
console.log(total, "bridge hacks,", total_stolen_usd, "USD");

python

import requests

r = requests.get("https://hackscan.fun/api/v1/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c", timeout=10)
report = r.json()
print("flagged" if report["flagged"] else "no match", [h["name"] for h in report["hits"]])

Data and licence

Hacks from DefiLlama; locations and attributions from public reporting; wallets from Etherscan labels (eth-labels, Forta), the MEW darklist, post-mortems and ZachXBT; sanctions from the US Treasury OFAC list. Free to use, including commercially. Please credit hackscan with a link. Data is shown as reported and may contain errors: it is not an accusation, and not financial or legal advice. Report an error.

v1.0.0 · 2026-11-02