Binance heist · read live from five chains

Reading the wires…

Hotwire Scan reads every wallet holding the October 29 Binance heist, on Bitcoin, Ethereum, TRON, the XRP Ledger and Solana, every two minutes. When a wire goes hot, it shows up here first.

Check an address Ignition feed (Atom)

Cold — unmoved since 30 Oct read Hot — part has moved Burnt out — emptied Filling — received more Spend in mempool

Loading live reads…

Unmoved—at live prices

Moved since 30 Oct read—baseline: Bitquery, 06:43 UTC

Frozen, checked on-chain now—issuer blacklist call

Bybit clock—Bybit 2025: ~all ETH moved in ~10 days

01The fuse box

The 18,270 BTC sits in 19 lots, peeled from Binance's hot wallet at 20:48 UTC on 29 Oct. A lot blows the moment one of its coins is spent — even while the spend is still in the mempool.

02Every other wire

Ethereum stashes, the TRON and XRP Ledger receivers, the Solana receiver, and the operator wallets whose nonce we watch for the next signature.

03Freeze ledger

Stablecoins can be switched off by their issuer. We call each token's own blacklist function on the attacker's receivers and read the balance that is stuck there — no press release required.

04Ignition feed

Written only when a live read differs from the last one by more than dust.

Subscribe: Atom · JSON

05Exposure check

Paste any Ethereum, Bitcoin, TRON, XRP or Solana address. We match it against every known heist and Binance address, flag look-alikes, and read its latest transactions for a direct hop to a heist wallet.

Try:

Poison radar

Vanity addresses that copy the first and last four characters of a heist wallet and spray 0-value transfers into its history. Never copy an address from a transaction list.

06Open API

Free, read-only, CORS-open. Build bots, dashboards or alerts on top of it.

GET /api/stateEvery wire, status, balances, totals, freeze ledger, 48h series

GET /api/events?kind=ignitionIgnition feed; kind = ignition · outflow · inflow · pending · baseline_drift · freeze_change · record

GET /api/check?address=…Exposure check (12 per minute per visitor)

GET /api/poisonLook-alike decoys seen in heist wallet histories

GET /api/walletsThe full address registry with roles and baselines

GET /feed.xmlAtom feed for readers, Slack and Discord bots

GET /card.svgLive status card, redrawn every minute

curl -s https://hotwire.pawww.sbs/api/state | jq '.wallets[] | select(.status != "cold") | {label, status, balance}'

07Method & sources

Addresses & baseline. The wallet list and the holdings we compare against come from Bitquery's investigation, read from each chain at 06:43 UTC on 30 Oct 2026. "Moved" always means moved since that read.

Live reads. Bitcoin via Blockstream/mempool.space Esplora, Ethereum via public JSON-RPC, TRON via TronGrid, XRPL via public rippled, Solana via public RPC, prices via CoinGecko. A failed read keeps the last good value and is marked stale.

Totals elsewhere. Stolen ~$6.3B (Binance; Elliptic $6.43B), frozen or seized $2.85B (Elliptic). Attribution to TraderTraitor is the assessment of Chainalysis and TRM Labs; no government has confirmed it.

Limits. We watch known wallets; new hops appear once a move reveals them. The exposure check reads one page of recent history and one hop only. Nothing here is legal, compliance or investment advice.