LIVE Real-time analytics · Live alerts · Every major exchange

Know the second a crypto exchange gets hacked.

HACKWATCH watches 450+ exchange wallets, 40 hacks and 221 wallets tied to North Korea's Lazarus Group live, and alerts you in plain English with sources.

Hacks show up on-chain before they hit the news.

$HACK CA9uRBxzQjsNxpJ53xaoUMpqqdtTKhwpCoHuueE2Fpumppump.fun

Is something happening on-chain right now?

LIVEStatus

Checking…

Alert activity, last 7 days (hourly)

What you can do with HACKWATCH

01See if something is happening right now

One status, updated every few minutes, covering exchanges, hacks and Lazarus wallets.

02Watch exchange wallets

Binance, Coinbase, OKX, Kraken and more. We flag huge transfers and sudden drains.

03Follow stolen funds after a hack

Recent hacks with who's been blamed, and live moves from wallets named in public write-ups.

04Track North Korea's Lazarus Group

Every wallet the US Treasury (OFAC) or FBI has publicly tied to Lazarus, watched on Bitcoin and Ethereum.

05Get alerts

Browser notifications while the page is open, or subscribe by RSS or JSON feed. No sign-up.

06Look up any address

Paste a wallet to check it against our exchange registry, hack lists and Lazarus list.

How it works

We watch public wallets.Addresses come from official sanctions lists, FBI statements, analyst post-mortems and open exchange-label datasets.
We flag unusual moves.Big transfers, sudden balance drops, money going to mixers or hacker wallets, and funds split fast across many new wallets.
You get a plain-English alert with sources.Each alert links to the transaction and to where the label came from, so you can check it yourself.

What we track

Live alerts

Exchanges

Hacks

Recent incidents from DefiLlama's public hacks list. We follow wallets named in public post-mortems.

Lazarus Group

Wallets named by OFAC or the FBI, grouped into clusters. Storylines are built automatically from the logged movements.

Cluster map size = number of addresses · drag to explore

Highest-scoring connected wallets

Methodology

Terms

Tracked wallet: An address named by a public source. Every label links to it.
Hot / cold wallet: Hot wallets pay out withdrawals; cold wallets hold reserves. Big moves between them are often routine.
Score (0–100): How closely a movement matches known hack and laundering patterns. A pattern match, not proof.
Peel chain: Funds moved step by step, peeling off a small slice each time.
Mixer: A service that pools coins to hide where they came from (e.g. Tornado Cash).
Bridge: A service that moves funds to another blockchain.
Fan-out: Money split across many new wallets very quickly.

How alerts are made

The pipeline runs continuously on GitHub Actions, refreshing every few minutes. It reloads the OFAC sanctions list, FBI-published addresses, DefiLlama's hacks list, the Elliptic Binance-hack blocklist and open exchange-label datasets, then reads recent transactions from Blockscout (Ethereum, Optimism, Polygon) and Blockstream (Bitcoin). Busy exchange wallets are checked in rotation. Prices come from DefiLlama.

Attribution badges

Government named by a government body · Analyst named by a blockchain-analytics firm · Unattributed no public attribution yet.