# three.ws Market Hacks — Crypto Security Incident Feed

> three.ws Market Hacks — Crypto Security Incident Feed is a paid API for AI agents from three.ws, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-11).

Returns a paginated, searchable list of historical cryptocurrency hacks and security incidents with amounts stolen, techniques used, and chain information.

## Facts

- Endpoint: GET https://three.ws/api/x402/market-hacks?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/three-ws-market-hacks-crypto-security-incident-feed-070e1c92
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TP0HRHqQwKddZMtZIt5Lj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability three-ws-market-hacks-crypto-security-incident-feed-070e1c92
```

Example prompt: Give me the top 50 crypto hacks sorted by amount stolen, and search for any incidents involving 'bridge' attacks — I want names, chains, techniques, and dollar amounts.

## When to prefer this

Use this endpoint when you need structured, queryable data on historical cryptocurrency security incidents including hack names, attack techniques, chains affected, and USD amounts. Prefer it over manual web searches when you need programmatic access to aggregate statistics or want to search across many incidents at once. Particularly useful for security researchers, DeFi risk analysts, or agents building crypto threat intelligence dashboards.

## Known failure modes

- Invalid limit value outside 1–200 range returns a validation error
- Offset beyond total record count returns an empty hacks array
- Invalid search string may return zero results without an error
- Payment not included or insufficient USDC results in 402 Payment Required response
- Network timeout for large paginated result sets

## How this service works

Make a 3D AI agent from a selfie in 60 seconds. Drop one HTML tag to embed it on any website. Agents think on IBM watsonx.ai (Granite); optionally charge per chat with built-in micropayments.

## Output

Returns a JSON object containing an array of hack incidents (each with name, bridge flag, affected chains, attack technique, and USD amount stolen) plus aggregate stats including incident count over the last 12 months and total amount stolen across all time. Supports pagination and case-insensitive text search.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "limit": {
       "type": "string",
       "description": "Rows per page, 1–200. Default 100."
      },
      "offset": {
       "type": "string",
       "description": "Pagination offset. Default 0."
      },
      "search": {
       "type": "string",
       "description": "Case-insensitive match over incident name, technique, and classification."
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "hacks": [
   {
    "name": "Ronin Network",
    "bridge": true,
    "chains": [
     "Ronin"
    ],
    "technique": "Compromised keys",
    "amount_usd": 624000000
   }
  ],
  "stats": {
   "incidents_12mo": 61,
   "total_stolen_all_time": 12400000000
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/three-ws-market-hacks-crypto-security-incident-feed-070e1c92/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from three.ws](https://www.zero.xyz/host/three.ws/llms.txt)