# hackscan

> Every crypto hack since 2011 (1331 incidents) with the story, the technique, the victim's country, the attacker when publicly attributed, attacker wallets, and ZachXBT's investigations. Read-only, free, no key.

## API
- [API docs](https://hackscan.fun/docs): REST endpoints, parameters, examples
- [OpenAPI 3.1](https://hackscan.fun/api/v1/openapi.json)
- GET https://hackscan.fun/api/v1/hacks?group=dprk&sort=amount: search hacks
- GET https://hackscan.fun/api/v1/hacks/{id}: one hack with wallets
- GET https://hackscan.fun/api/v1/address/{address}: check a wallet
- GET https://hackscan.fun/api/v1/investigations: ZachXBT posts
- GET https://hackscan.fun/api/v1/stats: totals and rankings

## MCP
- Endpoint: https://hackscan.fun/mcp (Streamable HTTP, stateless, no auth)
- search_hacks: Filter the hackscan database of crypto hacks since 2011 (DefiLlama + attributions + attacker wallets).
- get_hack: Full record of one hack by id (from search_hacks): description, location, every known attacker wallet with its source, and ZachXBT posts about it..
- check_address: Check an EVM, Bitcoin, Tron or Solana address against attacker wallets from hacks, ZachXBT theft addresses, Etherscan phishing labels and the US OFAC sanctions list.
- list_investigations: Posts by on-chain investigator ZachXBT about hacks, thefts, scams and exchange alerts, newest first, with the theft addresses he names and the hack each post is tied to..
- get_stats: Totals and rankings: stolen per year, per chain, per attack class, per victim country, per attacker, and the 10 largest hacks..

## Pages
- [Globe](https://hackscan.fun/): hacks by country
- [Database](https://hackscan.fun/database): filterable table, CSV export
- [Analysis](https://hackscan.fun/analysis): rankings by attacker, chain, class, country
- [Investigations](https://hackscan.fun/investigations): ZachXBT posts
- [Ask](https://hackscan.fun/ask): questions in plain English