# trace3 — Binance 2026-10-29 hot-wallet theft: attacker address list

Independent on-chain tracking. An address is listed only after its inflow from this incident (2026-10-29 UTC) has been verified on-chain.
No sign-in, no API key, CORS allowed, rate limited (429 when over the limit).

## GET https://trace3.bgblockchain.xyz/api/holdings

Every address the attacker has controlled, grouped by chain, including addresses that have since been emptied.
The list only grows, so it can be used as a blocklist. Within each chain, addresses that still hold funds come first.

Response (JSON object; keys = chain, values = address arrays):
  {"eth": ["0x…", …], "arb": […], "op": […], "base": […], "polygon": […], "avax": […], "btc": […], "tron": […], "xrp": […], "sol": […]}

- EVM addresses are lower-case. An EVM address used on several chains is listed under each chain.
- Data time: response header x-snap-ts (Unix seconds). Balances are refreshed from nodes about every 5 min (EVM) / 10 min (BTC, TRON, XRP, SOL).
- Cached 30 s. On 503 ("not ready"), keep the list you last fetched; do not treat it as empty.

Docs: https://trace3.bgblockchain.xyz/api · OpenAPI: /api/openapi.json (Chinese), /api/openapi.json?lang=en (English)
中文说明见 /api。