LIVE Real-time analytics · Live alerts · Every major exchange
Know the second a crypto exchange gets hacked.
HACKWATCH watches 450+ exchange wallets, 40 hacks and 221 wallets tied to North Korea's Lazarus Group live, and alerts you in plain English with sources.
Hacks show up on-chain before they hit the news.
Is something happening on-chain right now?
Checking…
What you can do with HACKWATCH
One status, updated every few minutes, covering exchanges, hacks and Lazarus wallets.
02Watch exchange walletsBinance, Coinbase, OKX, Kraken and more. We flag huge transfers and sudden drains.
03Follow stolen funds after a hackRecent hacks with who's been blamed, and live moves from wallets named in public write-ups.
04Track North Korea's Lazarus GroupEvery wallet the US Treasury (OFAC) or FBI has publicly tied to Lazarus, watched on Bitcoin and Ethereum.
05Get alertsBrowser notifications while the page is open, or subscribe by RSS or JSON feed. No sign-up.
06Check a walletCompare an address with our exchange registry, hack lists and Lazarus list.
How it works
- We watch public wallets.Addresses come from official sanctions lists, FBI statements, analyst post-mortems and open exchange-label datasets.
- We flag unusual moves.Big transfers, sudden balance drops, money going to mixers or hacker wallets, and funds split fast across many new wallets.
- You get a plain-English alert with sources.Each alert links to the transaction and to where the label came from, so you can check it yourself.
What we track
Live alerts
Exchanges
Hacks
Recent incidents from DefiLlama's public hacks list. We follow wallets named in public post-mortems.
Lazarus Group
Wallets named by OFAC or the FBI, grouped into clusters. Storylines are built automatically from the logged movements.
Highest-scoring connected wallets
Check a wallet against our data
Compares an address with HACKWATCH's exchange registry, hack-flagged lists and the OFAC/FBI Lazarus list. Not a block explorer.
Get alerts
No account, no email list. Pick what works for you.
Methodology
Terms
- Tracked wallet
- An address named by a public source. Every label links to it.
- Hot / cold wallet
- Hot wallets pay out withdrawals; cold wallets hold reserves. Big moves between them are often routine.
- Status
- Safe: funds stayed with wallets labeled as the same exchange, moved between labeled exchanges, were an inbound deposit, or a balance drop was matched by an internal refill or transfer within 60 min. Monitoring: large move to an unlabeled address, or a drop with no matching internal transfer. Risk: funds sent by an OFAC/FBI-listed wallet or a wallet named in a hack post-mortem, or sent to a flagged wallet or mixer.
- Risk score (0–100)
- How closely a movement matches known hack and laundering patterns. A pattern match, not proof.
- Peel chain
- Funds moved step by step, peeling off a small slice each time.
- Mixer
- A service that pools coins to hide where they came from (e.g. Tornado Cash).
- Bridge
- A service that moves funds to another blockchain.
- Fan-out
- Money split across many new wallets very quickly.
How alerts are made
The pipeline runs continuously on GitHub Actions, refreshing every few minutes. It reloads the OFAC sanctions list, FBI-published addresses, DefiLlama's hacks list, the Elliptic Binance-hack blocklist and open exchange-label datasets, then reads recent transactions from Blockscout (Ethereum, Optimism, Polygon) and Blockstream (Bitcoin). Busy exchange wallets are checked in rotation. Prices come from DefiLlama.
Attribution badges
Government named by a government body · Analyst named by a blockchain-analytics firm · Unattributed no public attribution yet.