EllipticNot published by vendorVerified 2026-10-31

Elliptic Binance hack blocklist MCP, free crypto exploit address blocklist API no key

Elliptic, the blockchain analytics company, publishes the addresses its investigators have tied to the October 29, 2026 Binance theft as a free feed: one CSV file and one remote MCP server with a single read-only tool. No account and no key. It covers this one incident only, so it is a targeted blocklist, not a general sanctions or risk screen.

CompareDocs

Verified factsChecked 2026-10-31

PriceFree. Elliptic describes it as a free data feed that needs no account or API key, for both the CSV and the MCP server.1 [Verified 2026-10-31]
API key / authNone. Our keyless MCP initialize, tools/list and tools/call (get_binance_hack_blocklist) and a plain GET of the CSV all returned HTTP 200 on 2026-10-31. tools/call also worked without first opening a session.2 [Verified 2026-10-31]
Rate limit60 requests a minute on the MCP server, from the ratelimit-limit: 60 and x-ratelimit-limit-minute: 60 headers on our calls (2026-10-31). Elliptic publishes no limit for the CSV, which is served from a CloudFront CDN.2 [Verified 2026-10-31]
License / termsNot published by vendor. The blocklist page carries no license or reuse terms, and Elliptic’s legal page lists only its regional customer terms and conditions (UK, US, Japan, Singapore). The page does invite compliance teams to load the addresses into their own screening systems.3 [Verified 2026-10-31]
CoverageThe Binance hack of October 2026 only. Elliptic’s FAQ says it is not a sanctions or risk check and that an address missing from the list says nothing about its wider risk.1 [Verified 2026-10-31]
Size and freshness5,245 lines and 5,241 distinct addresses on 2026-10-31; the CSV’s Last-Modified header was Sat, 31 Oct 2026 15:37:33 GMT. Elliptic updates it as its investigators trace new addresses.4 [Verified 2026-10-31]
MCP toolOne read-only, idempotent tool, get_binance_hack_blocklist, with an empty input schema; the response is about 430 KB of JSON. The server identified itself as Kong 3.15.0.6 and speaks MCP protocol version 2025-06-18 over Streamable HTTP.2 [Verified 2026-10-31]

FeaturesChecked 2026-10-31

YesNoN/ANot published
CapabilityValueNote
StatusNo beta, GA or version label on the blocklist page; Elliptic launched the feed after the 2026-10-29 Binance incident and gives no SLA or end date.Not published1 [Not published by vendor: checked 2026-10-31 on https://www.elliptic.co/binance-hack-2026-blocklist/]No beta, GA or version label on the blocklist page; Elliptic launched the feed after the 2026-10-29 Binance incident and gives no SLA or end date.
API key requiredNo key. Keyless MCP initialize, tools/list and tools/call, and a plain GET of the CSV, all returned HTTP 200 on 2026-10-31.No2 [Verified 2026-10-31 by test request to https://public.mcp.elliptic.co/mcp]No key. Keyless MCP initialize, tools/list and tools/call, and a plain GET of the CSV, all returned HTTP 200 on 2026-10-31.
Free tierFree. Elliptic calls it a free data feed with no account or API key, for both the CSV and the MCP server.Yes1 [Verified 2026-10-31 on https://www.elliptic.co/binance-hack-2026-blocklist/]Free. Elliptic calls it a free data feed with no account or API key, for both the CSV and the MCP server.
Rate limitratelimit-limit: 60 and x-ratelimit-limit-minute: 60 headers on our MCP calls; no limit is published for the CDN-served CSV.60 requests/min (MCP)2 [Verified 2026-10-31 by test request to https://public.mcp.elliptic.co/mcp]ratelimit-limit: 60 and x-ratelimit-limit-minute: 60 headers on our MCP calls; no limit is published for the CDN-served CSV.
Official MCP serverYes, public.mcp.elliptic.co/mcp. One read-only tool, get_binance_hack_blocklist, with no input; Streamable HTTP, no sign-in (tools/list on 2026-10-31).Yes2 [Verified 2026-10-31 by test request to https://public.mcp.elliptic.co/mcp]Yes, public.mcp.elliptic.co/mcp. One read-only tool, get_binance_hack_blocklist, with no input; Streamable HTTP, no sign-in (tools/list on 2026-10-31).
Official SDKNo SDK: the CSV is one address per line and the MCP server is the integration; Elliptic’s page shows a curl download and client setup only.N/A1 [Verified 2026-10-31 on https://www.elliptic.co/binance-hack-2026-blocklist/]No SDK: the CSV is one address per line and the MCP server is the integration; Elliptic’s page shows a curl download and client setup only.
Data license / termsThe blocklist page states no license or reuse terms; Elliptic’s legal page lists only regional customer terms and conditions.Not published3 [Not published by vendor: checked 2026-10-31 on https://www.elliptic.co/legal/]The blocklist page states no license or reuse terms; Elliptic’s legal page lists only regional customer terms and conditions.
Commercial use allowedNo reuse terms are published. The page invites compliance and engineering teams to load the addresses into their own screening systems, but says nothing about redistribution.Not published1 [Not published by vendor: checked 2026-10-31 on https://www.elliptic.co/binance-hack-2026-blocklist/]No reuse terms are published. The page invites compliance and engineering teams to load the addresses into their own screening systems, but says nothing about redistribution.
CORS / browser useNo CORS. An OPTIONS preflight to the MCP endpoint returned 405, and the CSV GET carried no Access-Control-Allow-Origin header.No2 [Verified 2026-10-31 by test request to https://public.mcp.elliptic.co/mcp]No CORS. An OPTIONS preflight to the MCP endpoint returned 405, and the CSV GET carried no Access-Control-Allow-Origin header.
Freshness / coverageCSV Last-Modified Sat, 31 Oct 2026 15:37:33 GMT; 5,245 lines, 5,241 distinct after folding 0x case duplicates.Updated as traced; 5,241 addresses4 [Verified 2026-10-31 by test request to https://data-cdn.elliptic.co/blocklists/binance-hack-blocklist.csv]CSV Last-Modified Sat, 31 Oct 2026 15:37:33 GMT; 5,245 lines, 5,241 distinct after folding 0x case duplicates.

What it does

The feed has two doors to the same list. The CSV at https://data-cdn.elliptic.co/blocklists/binance-hack-blocklist.csv is one address per line, with no header and no chain column, and the same URL always serves the newest copy. The MCP server at https://public.mcp.elliptic.co/mcp exposes one tool, get_binance_hack_blocklist, which takes no input and returns every address in a structured addresses array. Because the tool takes no input, the address you are checking never leaves your side: the assistant downloads the whole list and does the comparison itself. On 2026-10-31 the list held 5,245 lines (5,241 distinct addresses once 0x duplicates in two letter cases are folded together): 3,269 Tron, 1,918 EVM (0x), 50 Bitcoin and a few others. Elliptic’s own page tells engineering teams to refetch the CSV on a schedule, for example hourly, and to compare 0x addresses in lowercase but match Bitcoin, Tron, Solana and XRP Ledger addresses exactly.

Working exampleRun 2026-10-31

ShellRequest
curl -sS -X POST "https://public.mcp.elliptic.co/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_binance_hack_blocklist","arguments":{}}}'

Response (trimmed)

HTTP responseResponse
HTTP 200 text/event-stream (run 2026-10-31, no key, no session; trimmed)
ratelimit-limit: 60
event: message
data: {"id":1,"result":{"isError":false,
 "structuredContent":{"addresses":[
   "0x001851999de3072a538951efbb2250fffed286e3",
   "0x001911db033d26170f9958215ed1ed9967e453a4",
   "0x001aaf871bfabde5fd9872c19df0770923152646", ...]},
 "content":[...]},"jsonrpc":"2.0"}
// 5,245 entries in addresses, the same count as the CSV

Agent setup

Prompt to give your agent

Prompt
Use the Elliptic Public MCP server. When I paste crypto addresses, call get_binance_hack_blocklist once, then check each address: compare 0x addresses in lowercase and every other address exactly as written. For each one, say "on the list" or "not on the list", and state that the list covers only the October 2026 Binance hack, so "not on the list" is not a clean bill of health. If I paste more than about 20 addresses, tell me to screen them with the CSV in code instead.

Agent / MCP-style tool snippet

Shell
// Claude Code
claude mcp add --transport http elliptic-public https://public.mcp.elliptic.co/mcp
JSON
// Cursor (.cursor/mcp.json) or any client that takes a remote URL
{
  "mcpServers": {
    "elliptic-public": { "url": "https://public.mcp.elliptic.co/mcp" }
  }
}
JavaScript
// Bulk or scheduled screening: load the CSV in code, not through the chat
// (Node 18+)
const res = await fetch('https://data-cdn.elliptic.co/blocklists/binance-hack-blocklist.csv');
const list = new Set((await res.text()).split('\n').map((a) => a.trim()).filter(Boolean)
  .map((a) => (a.startsWith('0x') ? a.toLowerCase() : a)));
const norm = (a) => (a.startsWith('0x') ? a.toLowerCase() : a);
console.log(list.has(norm('0x001851999DE3072a538951efbb2250fffed286e3'))); // true

Fit and safety

Good for

  • Checking a deposit or withdrawal address against the Binance hack list before crediting it
  • An hourly job that refreshes an exchange or wallet blocklist from the CSV
  • Letting a support or compliance analyst ask Claude whether a few addresses are flagged
  • Looking back at activity since October 29, 2026 for exposure to the stolen funds

Watch out

  • Do not use it as a sanctions or AML screen. It lists addresses tied to one theft; for sanctioned addresses use OFAC’s lists, and for broad risk scoring a paid screening product.
  • Do not read “not on the list” as safe. Elliptic says a missing address says nothing about its wider risk, and the list keeps growing as funds move.
  • Do not ask a chat assistant to compare hundreds of addresses. Elliptic warns assistants can make mistakes with long lists; load the CSV into your own system and match in code.
  • Do not lowercase Bitcoin, Tron, Solana or XRP Ledger addresses. Only 0x addresses are case-insensitive; the others must match exactly.
  • Do not cache a copy for days. The attacker is still moving funds, so refetch at least hourly while the incident is active.
  • Do not republish or resell the list without checking with Elliptic. No license or reuse terms are published for it.

Alternatives

OFAC Sanctions List ServiceThe U.S. Treasury’s official SDN and consolidated lists, free to download; OFAC adds digital currency addresses for some blocked persons.
cve.now API & MCPFree, keyless security data for agents, for software vulnerabilities rather than wallet addresses.
DexPaprika APIFree, keyless on-chain DEX prices and pools when the agent needs market context around an incident.
Morpho MCPKeyless, read-only DeFi lending data over MCP, another hosted crypto server with no sign-up.

FAQ

Does the Elliptic blocklist MCP server need an API key?

No. Add https://public.mcp.elliptic.co/mcp as a remote MCP server with no sign-in. The CSV download needs no key either.

What is the rate limit?

60 requests a minute on the MCP server, per the rate-limit headers on our 2026-10-31 calls. Each call returns the whole list, so you rarely need more than one.

Does Elliptic see the addresses I check?

No. The tool takes no input; your assistant downloads the full list and does the comparison locally, as Elliptic’s FAQ explains.

Why do some 0x addresses appear twice?

They are listed in both lowercase and mixed case. Compare 0x addresses in lowercase; on 2026-10-31 that folded 5,245 lines into 5,241 distinct addresses.

Compare

Put Elliptic Binance Hack Blocklist (MCP server + CSV) side by side with other free agent tools on keys, limits, MCP support, licensing and CORS. Open the comparison grid →

SourcesFootnotes

  1. 1elliptic.co/binance-hack-2026-blocklistVerified 2026-10-31
  2. 2public.mcp.elliptic.co/mcpTested 2026-10-31
  3. 3elliptic.co/legalVerified 2026-10-31
  4. 4data-cdn.elliptic.co/blocklists/binance-hack-blocklist.csvVerified 2026-10-31