They took $6.36B reported by TRM Labs. Largest theft in crypto's history.
Live figures cover the Bitcoin and Ethereum wallets UNSAFU traced itself, re-read every minute. Tron, XRP, Solana and L2 legs are shown as reported.
The Nineteen
At 20:20 UTC, 18,270.2 BTC left Binance in one block. By 20:48 a peel chain had split it into nineteen addresses. None has moved since. Each locker is one address, read every minute.
Hover or tap a locker to look inside. Open it for the full file.
Replay the night
From the first Tornado Cash withdrawal to the last sweep. Drag the playhead. Every on-chain step links to its transaction.
The trail
Every wallet UNSAFU watches and where its money came from. When a watched wallet pays a fresh address, the indexer follows it on its own and adds it here.
- holding
- frozen funds
- has sent funds
- empty hop
Who froze what
Bitcoin, XRP and SOL have no issuer, so nobody can freeze them. Stablecoins do. Where we can read the freeze flag on-chain, we do.
Did heist money touch this wallet?
For desks, OTCs and anyone who just got paid by a stranger. Paste an Ethereum or Bitcoin address. We look for direct transfers to or from any wallet on the trail.
Tripwire
Get pinged the minute a lot leaves its locker: on Telegram through our bot, or in your own Discord or Slack channel.
Movement log
Everything the indexer has seen change since it started watching. RSS.
Open data
Free JSON, CORS open, no key. Build your own bot on it.
GET /api/v1/ledgerLive totals, prices, reported figures with sources
GET /api/v1/lotsThe nineteen BTC lots and their state
GET /api/v1/walletsEvery watched wallet with its last snapshot
GET /api/v1/wallet/:chain/:addressOne wallet, its events and children
GET /api/v1/eventsMovement log, newest first (?before=unix)
GET /api/v1/graphNodes and edges of the trail
GET /api/v1/timelineThe night, step by step, with sources
GET /api/v1/check/:addressDirect exposure check (15 per 5 min)
curl -s https://unsafu.pawww.sbs/api/v1/lots | jq '.lots[] | select(.status != "dormant")'