KadenaTrace API for developers

KadenaTrace's data is open. The endpoints below are the same ones the site uses, free and without a key. They return JSON (one returns RSS). Every address is identified by network and address; every claim links to its evidence.

Check an address

GET https://trace.kadena.ws/api/risk?address=<address>&network=<network>

The address check behind Check, for wallets to call before a transfer. network is optional (ethereum, tron, bitcoin, solana, bsc, arbitrum, base, polygon, optimism, avalanche, kadena); without it, every network the address format fits is checked.

{
  "address": "TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A",
  "networks": [{ "id": "tron", "name": "TRON" }],
  "risk": "high",
  "summary": "Do not send: this address is linked to reported stolen funds.",
  "reasons": [{ "level": "high", "kind": "compromised", "text": "Reported as stolen from in case KT-18 …", "link": "https://trace.kadena.ws/case/KT-18" }],
  "label": null
}
  • risk is high, medium or none. none means nothing is on record, not that the address is safe; show the summary as it is.
  • reasons[].kind says why: attacker (attributed by a source), compromised (funds were stolen from it), received (traced stolen funds arrived, with the hop count), frozen (an issuer froze it, read on chain), named (mentioned in a report, not attributed), victim, mixer.
  • Limits: 60 checks a minute per IP; responses are cacheable for 60 seconds; any origin may call it from a browser.

Incidents

GET https://trace.kadena.ws/api/incidents?days=14&sort=recent&network=<network>&kind=<kind>

Hacks, exploits, phishing, scams, stablecoin freezes and unconfirmed early warnings picked up from security firms, hack databases and the chain. days is 1 to 90; sort is recent or amount. Each incident has verified (true, false, or null for kinds that are not thefts); totals count only verified thefts.

GET https://trace.kadena.ws/api/incidents/<id> returns one incident with its timeline (?show=key|moves|all&page=1), a facts block (what is reported, confirmed, recorded on Kadena, attributed, deposited, frozen, and how complete the trace is), and its guide.

Cases and their moves

GET https://trace.kadena.ws/api/cases?limit=50 lists cases recorded on Kadena (at most 200).

GET https://trace.kadena.ws/api/cases/KT-13?page=1&filter=ends returns one case: the starting address, its status, the moves of the funds (paged, newest first; filter=ends keeps only moves into a labeled service), each with its source-chain transaction and its record on Kadena, and the wallets still holding funds.

Every move, as it happens

GET https://trace.kadena.ws/api/feed?case=KT-13&chain=tron&token=USDT&limit=100&offset=0 returns recorded moves across all cases, newest first (at most 200 a page); GET /api/feed/facets lists what it can be filtered by. GET https://trace.kadena.ws/api/feed.rss is the same as RSS.

Monthly reports and guides

GET /api/reports lists the months; GET /api/reports/2026-10 returns one month's verified thefts and freezes. GET /api/guides and GET /api/guides/<slug> return the guides.

What the data claims, and what it does not

  • Amounts are as reported by the sources, and trace totals are lower bounds when the trace was partial; the incident's facts.coverage says which.
  • An address is never a person. An address is called the attacker's only when a source attributes it.
  • A deposit at an exchange is not a freeze. Freezes are reported only when read from an issuer's contract.
  • Every move recorded on Kadena can be checked independently in the public contract free.kadena-trace on chain 1; each move's attestation gives the Kadena request key.

Fair use

Please identify your app in the User-Agent, cache what you can, and do not run bulk scans through the address check. For higher volumes or a signed feed of incidents, write to @KadenaTrace on X.