v0.29.0 — Bybit reserve wallets; ScamSniffer phishing list

0.29.0

Added

• Bybit's current reserve wallets: 274 addresses on Bitcoin, Ethereum,
  BNB Chain, Arbitrum, Base, Optimism, Polygon, Solana, Tron and TON, from
  the "verified wallets" table of Bybit's monthly Hacken proof-of-reserves
  audit (snapshot 2026-09-23, linked from Bybit's audit-report page). Bybit
  was covered only by 12 wallets from its December 2022 list. Of those, 8 are
  still listed and now cite the 2026 audit. The other 4 keep their label,
  marked as possibly retired. tonapi independently names four of the TON
  wallets "Bybit 7"–"Bybit 10". Live balances on single wallets: 38,194 BTC,
  340,000 SOL, 10,973 ETH.
• tools/refresh_por.py --bybit FILE: Hacken audits are read by one parser
  for MEXC and Bybit, and an EVM address listed for several networks becomes
  one label naming them all. An exchange's older list is renewed where the
  current one still has the wallet.

Fixed

• A TON label written as "EQ…" was never found. Lookups use the
  canonical non-bounceable "UQ…" spelling, so a curated key in the
  bounceable form matched nothing. Keys are now normalised when the label
  set loads, and the refresh tool writes the canonical form. No shipped
  label was affected; Bybit's audit lists both spellings.

0.28.0

Added

• ScamSniffer's phishing blacklist in update-labels. About 2,500 EVM
  addresses of phishing sites and wallet drainers (github.com/scamsniffer/
  scam-database, updated daily with a 7-day delay), labelled scam. It is
  downloaded on the user's machine, not shipped (the list is GPL-licensed).
  OFAC's sanctions label wins where both name an address.
• check names payments to a listed phishing or sanctioned address,
  in the CLI and the web UI, with advice to revoke token approvals. A
  phishing site or a signed approval takes money in one transfer, so the
  burst-based drain check saw nothing; on a real victim's wallet it now shows
  the 0.1 WETH sent to a ScamSniffer-listed drainer.

Fixed

• Downloaded lists never shrank. An address taken off a list (a false
  positive corrected) kept its label forever. Each download now replaces that
  list's previous copy. An empty or failed download keeps the old copy, and
  a list that failed this time still outranks a lower one.
• Downloaded labels carried no source, so assess called even OFAC's
  sanctions label "inherited rather than evidenced". Each now records its
  list, its download date and its kind (official-list, research).

v0.27.0 — refreshing exchange reserve-wallet labels

Added

• tools/refresh_por.py — refreshes the exchange reserve-wallet labels
  as the exchanges republish their lists: Binance (its PoR feed), HTX (the
  monthly snapshot on its GitHub) and MEXC (the monthly Hacken audit PDF,
  read with a stdlib-only PDF reader; ligatures resolved by checksum). It
  reports newly listed and no-longer-listed wallets; --write adds the new
  ones with the same naming and sources, and marks the others "possibly
  retired" without dropping them. Run for this release:
  • Binance: 3 Bitcoin reserve wallets listed on 2026-10-22 (3,300–5,600 BTC
    each).
  • HTX, snapshot 2026-10-01: its first EVM wallets (3; a contract that holds
    reserves is left out — it is shared, not HTX's), and one Bitcoin wallet
    no longer listed.
  • MEXC: the 2026-10-09 audit reads back the same 41 wallets imported in
    0.26.0 — a cross-check of that import by a second parser.

v0.26.0 — MEXC reserve wallets

Added

• MEXC's reserve wallets: 41 addresses on Bitcoin, Ethereum, BNB Chain,
  Arbitrum, Base, Optimism, Polygon, Solana, Tron and TON, from the "verified
  wallets" table of MEXC's Hacken proof-of-reserves audit of 2026-10-09
  (ownership proven by a test transaction from each address), linked from
  MEXC's own audit-report page. Live balances match an exchange's: 1,000 BTC,
  10,000–15,000 ETH, 24,500 SOL, 6.2M TRX on single wallets.
• MEXC's law-enforcement portal in evidence packs: funds traced to MEXC
  now come with mexc.com/support/ticket/submit/law-enforcement-requests,
  as KuCoin's did.

v0.24.0 — Etherscan errors are no longer empty wallets

Fixed

• BSC, Optimism and Base looked empty on a free Etherscan key. Etherscan's
  free plan does not serve those chains and says so in an error, but the
  error passed for "no transactions": every wallet there showed a zero
  balance and no history, and the answer was cached for an hour. Any error
  Etherscan returns is now reported — for these chains with what is needed
  (a paid plan) — and never cached; errors cached by older versions are
  ignored. crypttrace chains and the README say which chains need the paid
  plan.
• A network failure talking to Etherscan is reported as such instead of
  surfacing as a raw requests exception.
• crosschain silently skipped every chain it could not read, so "no
  arrival found" also covered chains it never searched. It now lists them
  under "Not searched".

v0.23.0 — Binance reserve wallets on EVM chains

Added

• Binance's reserve wallets on the EVM chains: 78 addresses from Binance's
  own proof-of-reserves list, on Ethereum, BNB Chain, Arbitrum, Polygon, Base
  and Optimism (11 custodied by Ceffu); each label names the networks
  Binance lists it for. Five long-known Binance hot wallets (Binance 14–18)
  now carry that list as their source instead of none. Before, EVM labels
  for Binance stopped at those five.
• Three Bitcoin reserve wallets Binance listed since the last import.

v0.22.0 — first funder from the start of history

Fixed

• funder named a recent sender as a busy wallet's first funder. It
  read the latest 200 transfers and took the oldest of those, so on any
  wallet with a longer history the "first funding" was simply the start of
  that window — on a Binance wallet on Tron, a payment from today instead of
  the real one from 2021. On EVM chains, Tron and TON the history is now read
  from its start (Etherscan sort=asc, TronGrid order_by=block_timestamp,asc,
  toncenter sort=asc), unless the stored history is already complete. The
  same goes for cluster, whose siblings and children rest on first fundings.
  Bitcoin and Solana explorers list newest first only; there it is still the
  earliest of the latest transfers.

v0.21.0 — deeper Solana history

Added

• Deeper Solana history. Signatures are read page after page and failed
  transactions are skipped before they are fetched. The latest 50 transactions
  per address on the public endpoint (was 25), paced to its real limit of
  about one call a second instead of tripping into 10-second back-offs; up to
  1,000, fetched in parallel, with your own endpoint
  (CRYPTTRACE_SOLANA_RPC). CRYPTTRACE_SOLANA_MAX_TXS overrides.

Fixed

• Every Solana version-1 transaction was silently dropped: they were
  requested with maxSupportedTransactionVersion: 0, the node refused, and
  the error was swallowed. Stored Solana history is read again once.
• Failed Solana transactions were counted as transfers that never
  happened.

v0.20.0 — EVM clustering by gas funding

Added

• EVM clustering by gas funding — crypttrace cluster 0x… (Bitcoin keeps
  common-input ownership). Siblings: wallets whose first funding came from the
  same wallet; children: wallets this one funded first. Same-day funding with
  similar amounts, or many similar fundings, is a strong link. A first funding
  from an exchange, mixer, bridge or any contract links nothing, and the
  result says so. On the Ronin bridge exploiter: 18 laundering wallets.

Fixed

• The internal-transaction flag was lost in the local store, so stored EVM
  history could not tell a contract's payout from a wallet's. It is kept now;
  EVM native history stored by 0.19 is read again once.
• Etherscan calls are paced (at most 5 a second, the free plan's limit) and
  a rate-limit reply is retried a few times instead of indefinitely.

v0.19.0 — EVM internal transactions

Added

• EVM internal transactions. ETH (and BNB, POL, …) that a contract sends —
  a withdrawal from a mixer or an exchange, ETH back from a DEX swap, a
  multisig payout — is now part of the native history, so trace, funder,
  victims, check and reports follow money through contracts. A wallet
  funded by a Tornado Cash withdrawal showed no funder before; now its funder
  is "Tornado Cash: 0.1 ETH".
• Keys from the Windows user environment. ETHERSCAN_API_KEY (and
  TRONSCAN_API_KEY) saved with SetEnvironmentVariable(..., "User") work in
  an already-open terminal.

Fixed

• Failed EVM transactions counted as transfers. A call that reverted moved
  nothing, but its value was booked as sent.
• Two Tornado Cash labels were wrong, checked against their own payouts:
  0x12d66f…b8fc pays out 0.1 ETH per withdrawal (was labelled 1 ETH), and
  0xd90e2f…f31b pays out 0.1, 1 and 10 ETH withdrawals — a router, not the
  0.1 ETH pool.

EVM native history stored by earlier versions is read again once, to pick up
the internal transactions.

v0.18.0 — Tronscan labels

Added

• Tron labels from Tronscan. With a free TRONSCAN_API_KEY, Tron addresses
  the curated set lacks get Tronscan's tags in traces, graphs, check and the
  evidence pack: exchange hot and cold wallets become exchange labels, a red
  tag (scam, phishing) makes the address a scam. Labels of kind
  explorer-tag with Tronscan as the source, cached for a week. No key, no
  requests. On an OKX reserve wallet's counterparties this names a 5M TRX
  sender "Okex 1".