{"openapi":"3.1.0","info":{"title":"trace3 · Binance 2026-10-29 Hot-Wallet Theft · Attacker Address List","version":"2026-10-30","description":"Addresses controlled by the attacker in the Binance hot-wallet theft (2026-10-29 UTC). Independent on-chain tracking: an address is listed only after its inflow from this incident has been verified on-chain.\n\n- **No sign-in or API key**; CORS is allowed.\n- Balances are read straight from nodes: about every 5 minutes on EVM chains, every 10 minutes on BTC / TRON / XRP / SOL. The data time is in the `x-snap-ts` response header (Unix seconds).\n- Rate limited; over the limit you get 429.\n\nOpenAPI 3.1: [Chinese /api/openapi.json](/api/openapi.json), [English /api/openapi.json?lang=en](/api/openapi.json?lang=en); plain-text guide [/llms.txt](/llms.txt)."},"servers":[{"url":"https://trace3.bgblockchain.xyz"}],"tags":[{"name":"lists","x-displayName":"Lists","description":"Attacker address list."}],"paths":{"/api/holdings":{"get":{"tags":["lists"],"operationId":"getHoldings","summary":"Attacker address list","description":"Every address the attacker has controlled, grouped by chain, **including addresses that have since been emptied**. The list only grows, so it can be used as a blocklist. Within each chain, addresses that still hold funds come first, followed by emptied ones.\n\n- Chains: `eth` `arb` `op` `base` `polygon` `avax` `btc` `tron` `xrp` `sol`; EVM addresses are lower-case. An EVM address used on several chains is listed under each of them.\n- An address stays on the list after it is emptied; that does not mean it is cleared. Addresses verified not to belong to the attacker are removed.\n- Cached for 30 s; the data time is in the `x-snap-ts` header.","responses":{"200":{"description":"Addresses grouped by chain","headers":{"x-snap-ts":{"$ref":"#/components/headers/SnapTs"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChainAddresses"},"example":{"eth":["0x1111111111111111111111111111111111111111","0x2222222222222222222222222222222222222222"],"btc":["bc1qxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"],"tron":["Txxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"]}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"},"example":{"error":"rate limited"}}}},"503":{"description":"Data not ready yet: keep the list you last fetched, do not treat it as empty","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"},"example":{"error":"not ready"}}}}}}}},"components":{"headers":{"SnapTs":{"description":"Data time (Unix seconds)","schema":{"type":"integer","examples":[1793361600]}}},"schemas":{"ChainAddresses":{"type":"object","description":"Keys are chain names (lower-case); values are the addresses on that chain","additionalProperties":{"type":"array","items":{"type":"string"}}},"Error":{"type":"object","properties":{"error":{"type":"string"}},"required":["error"]}}}}