v0.29.0 — Bybit reserve wallets; ScamSniffer phishing list

0.29.0

Added

• Bybit's current reserve wallets: 274 addresses on Bitcoin, Ethereum,
  BNB Chain, Arbitrum, Base, Optimism, Polygon, Solana, Tron and TON, from
  the "verified wallets" table of Bybit's monthly Hacken proof-of-reserves
  audit (snapshot 2026-09-23, linked from Bybit's audit-report page). Bybit
  was covered only by 12 wallets from its December 2022 list. Of those, 8 are
  still listed and now cite the 2026 audit. The other 4 keep their label,
  marked as possibly retired. tonapi independently names four of the TON
  wallets "Bybit 7"–"Bybit 10". Live balances on single wallets: 38,194 BTC,
  340,000 SOL, 10,973 ETH.
• tools/refresh_por.py --bybit FILE: Hacken audits are read by one parser
  for MEXC and Bybit, and an EVM address listed for several networks becomes
  one label naming them all. An exchange's older list is renewed where the
  current one still has the wallet.

Fixed

• A TON label written as "EQ…" was never found. Lookups use the
  canonical non-bounceable "UQ…" spelling, so a curated key in the
  bounceable form matched nothing. Keys are now normalised when the label
  set loads, and the refresh tool writes the canonical form. No shipped
  label was affected; Bybit's audit lists both spellings.

0.28.0

Added

• ScamSniffer's phishing blacklist in update-labels. About 2,500 EVM
  addresses of phishing sites and wallet drainers (github.com/scamsniffer/
  scam-database, updated daily with a 7-day delay), labelled scam. It is
  downloaded on the user's machine, not shipped (the list is GPL-licensed).
  OFAC's sanctions label wins where both name an address.
• check names payments to a listed phishing or sanctioned address,
  in the CLI and the web UI, with advice to revoke token approvals. A
  phishing site or a signed approval takes money in one transfer, so the
  burst-based drain check saw nothing; on a real victim's wallet it now shows
  the 0.1 WETH sent to a ScamSniffer-listed drainer.

Fixed

• Downloaded lists never shrank. An address taken off a list (a false
  positive corrected) kept its label forever. Each download now replaces that
  list's previous copy. An empty or failed download keeps the old copy, and
  a list that failed this time still outranks a lower one.
• Downloaded labels carried no source, so assess called even OFAC's
  sanctions label "inherited rather than evidenced". Each now records its
  list, its download date and its kind (official-list, research).