# three.ws DeFi Hack Check API

> three.ws DeFi Hack Check API is a paid API for AI agents from three.ws, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Returns a feed of recent DeFi/crypto protocol hack incidents with stats on stolen funds, filterable by protocol name

## Facts

- Endpoint: GET https://three.ws/api/x402/hack-check?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/three-ws-defi-hack-check-api-224eb8c3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_LChBh-i0QD9yL1umyb6JG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability three-ws-defi-hack-check-api-224eb8c3
```

Example prompt: Can you check if there have been any recent hacks or exploits involving the Ronin protocol? Show me the latest 10 incidents.

## When to prefer this

Choose this endpoint when you need structured, queryable data on DeFi hack incidents with financial statistics — especially useful for protocol risk assessment, security audits, investment due diligence, or monitoring the DeFi exploit landscape. Prefer it over general web search when you need machine-readable incident records with USD amounts, techniques, and chain details rather than news articles.

## Known failure modes

- No incidents found for a queried protocol name returns empty matches array
- limit parameter out of range (must be 1-50) returns validation error
- Payment not included or insufficient USDC triggers 402 Payment Required
- Protocol name substring match may return false positives for short or common terms
- Stale data if incident database has not been recently updated

## How this service works

Make a 3D AI agent from a selfie in 60 seconds. Drop one HTML tag to embed it on any website. Agents think on IBM watsonx.ai (Granite); optionally charge per chat with built-in micropayments.

## Output

A JSON object containing: a list of hack incidents (date, protocol name, whether a bridge was involved, chains affected, attack technique, USD amount stolen, amount returned, classification, source URL); aggregate stats for the past 12 months (incident count, total stolen, bridge hack share percentage, all-time total stolen); match count; and a verdict field indicating whether results are protocol-specific or market-wide.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "properties": {
      "limit": {
       "type": "integer",
       "default": 10,
       "maximum": 50,
       "minimum": 1,
       "description": "Incidents to return, newest first."
      },
      "protocol": {
       "type": "string",
       "description": "Protocol name to search (case-insensitive substring match). Omit for the latest incidents market-wide."
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ts": "2026-07-11T10:00:00Z",
  "query": null,
  "stats": {
   "incidents_12mo": 61,
   "total_stolen_12mo": 890000000,
   "bridge_hack_share_pct": 34.2,
   "total_stolen_all_time": 12100000000
  },
  "matches": 5,
  "verdict": "market-wide",
  "incidents": [
   {
    "date": "2026-06-28T00:00:00.000Z",
    "name": "Example Protocol",
    "bridge": false,
    "chains": [
     "Ethereum"
    ],
    "source": "https://example.com/post-mortem",
    "technique": "Price oracle manipulation",
    "amount_usd": 12000000,
    "returned_usd": null,
    "classification": "DeFi"
   }
  ],
  "total_lost_usd": 412000000
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/three-ws-defi-hack-check-api-224eb8c3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from three.ws](https://www.zero.xyz/host/three.ws/llms.txt)