Syscoin Hot Wallet Tracker

Track where SYS leaves the Binance hot wallet:

sys1qync7erear7cvpkysvv0a28mj45g2ps0kq9c6qs

The tracker uses the official Syscoin Native UTXO Blockbook explorer by default:

https://explorer-blockbook.syscoin.org/

It stores fetched transactions in SQLite, classifies hot-wallet outbound movements, aggregates first-hop destinations, and can optionally follow spent outputs to later hops.

Quick Start

python3 syscoin_tracker.py sync
python3 syscoin_tracker.py report --top 25 --csv destinations.csv
python3 syscoin_tracker.py serve

Then open:

http://127.0.0.1:8787

The dashboard has these pages:

• / tracks Binance hot-wallet recipient flows.
• /sentrynode tracks the current network sentry node list from RPC, setup/takedown dates, moved collateral destination, and exchange label when the moved-to address is known.
• /top-wallets shows grouped-wallet relationship estimates, followed by the top 100 individual address balances and Sentry counts at each collateral address. /top-wallets.json keeps exact address rows in wallets and relationship estimates separately in estimated_groups.
• /emissions shows indexed UTXO miner, sentry node, governance, NEVM miner reward, priority fee, and fee-burn data. /emissions.json exposes the same prebuilt data.

Manual top-wallet names can be added to wallet_labels.csv with address,name,label,status; use identified only for an explicitly identified address. Exchange names come from exchange_tags.csv, which also requires status=identified and records the attribution basis. Blank or unverified statuses are excluded. Existing manually recorded labels are not independent exchange attestations. Labels never propagate through funding or co-spend links.

The homepage uses the same completed address index as Top Wallets. During a rebuild it may show a dated, cached Blockbook balance instead; partial rankings remain marked provisional. Direct receipts are historical first-hop transfers to that exact address, not its current holdings or receipts of related addresses. Historical links include joint spending and collateral-funding payments; they cannot establish common ownership. The grouped view excludes recorded exchange and private identities, including their incident links, before connecting other addresses. Named exchange rows sum only explicitly recorded same-exchange addresses. Adjacent exchange links are relationship notes, not ownership labels. Node-linked groups contain recorded collateral but are not verified operators. Each group exposes its funded members and individual balances, and shows whether its grouping is estimated. Incomplete link/balance indexes make grouped rankings provisional without changing the status of the independent address table. The legacy cluster JSON export still returns available=false with link counts only, not holder rankings or exchange totals. Normal publication also replaces an existing top-wallet-clusters.json with these diagnostics, even when the historical link-index job is disabled. New address scans retain their starting height and confirmation target. Scans started after genesis stay provisional and cannot replace cached balances. Legacy indexes retain existing rows, but without recorded full-history coverage a missing row falls back to the dated cache or unavailable, rather than zero.

Vercel

This repo includes a Vercel Python function at api/index.py, so the same dashboard can be deployed without running a local process forever.

For live deployments, follow DEPLOYMENT.md. The production site uses both Vercel and the VPS-published static files on syscoin.dev; pushing GitHub or deploying Vercel alone is not enough for a complete update.

npx vercel
npx vercel --prod

On Vercel, the dashboard syncs on page request and uses /tmp SQLite caching while the function instance is warm. The page still refreshes every 60 seconds. Use the local serve command or an external database/cron worker if you need a fully persistent background indexer.

Useful Vercel environment variables:

SYS_TRACKER_SINCE_DATE="2026-04-14 12:30"
SYS_TRACKER_FROM_HEIGHT="2221358"
SYS_TRACKER_SYNC_INTERVAL="60"
SYS_TRACKER_NEXT_HOP_LIMIT="8"
SYS_TRACKER_NODE_SPEND_LIMIT="12"

Watch Mode

Poll the official Blockbook endpoint and print JSON alerts for new outbound sends:

python3 syscoin_tracker.py watch --interval 60

Post alerts to a Discord, Slack, or custom webhook:

SYS_TRACKER_WEBHOOK_URL="https://example.com/webhook" python3 syscoin_tracker.py watch

The webhook payload includes the transaction id, block height, UTC time, external SYS amount, and destination outputs.

Useful Reports

Recent-only report from a block height:

python3 syscoin_tracker.py report --since-height 2238000 --top 50

Report from the monitoring announcement timestamp onward. Date/time values without an explicit offset use Australia/Sydney by default:

python3 syscoin_tracker.py sync --since-date "2026-04-14 12:30"
python3 syscoin_tracker.py report --since-date "2026-04-14 12:30" --top 50 --csv destinations_since_monitoring.csv
python3 syscoin_tracker.py serve --since-date "2026-04-14 12:30"

The dashboard auto-syncs from Blockbook and refreshes the browser every 60 seconds by default. Change that cadence with:

python3 syscoin_tracker.py serve --since-date "2026-04-14 12:30" --sync-interval 30

Export every recipient address, ranked high to low by SYS amount:

python3 syscoin_tracker.py report --since-date "2026-04-14 12:30" --all-destinations --csv destinations_since_monitoring_all_ranked.csv

Exchange And Sentry Checks

Tracked address cards are configured in exchange_hot_wallets.csv and exchange_cold_wallets.csv. Only addresses also marked identified with the same exchange name in exchange_tags.csv appear publicly. Candidate records remain in the CSVs for research but do not contribute public labels or holdings.

Exchange	End wallet	Note
Bitget	sys1qwhd5dz4mxkfwylg9jz4x56ggnc4z2d22u4l78w	main hot/cold wallet
Gate	ScM7oHdCXXZistSxPr7YjxyZ8tUf3HG8c2	main hot wallet
MEXC	sys1qeyt05mxwlud4q66u8u2jtyq4markks4ru5ldk8	user-confirmed withdrawal source, tx 6fc58d94eeff904cd4890d90e5b6a7bd31737904d0aadab99524af60c792adc6

Known cold wallets live in exchange_cold_wallets.csv and are shown separately on the dashboard.

Exchange	Cold wallet	Note
Binance	SUBbe8vb7ng9CxZE9J3hma2CCkBh5VBHrv	confirmed cold wallet

Research routes can live in exchange_routes.csv; for example, your sys1qs05... Bitget deposit address is kept as a route to the Bitget end wallet, not as a direct exchange wallet. Routes never label the intermediate address as exchange-owned, including in the Sentry takedown destination table. The old MEXC sys1q796zh... and sys1q3ec7z... labels and Ex(Unknown) guesses are unverified and excluded pending stronger evidence. This does not assert that they are unrelated; it avoids presenting that relationship as established ownership.

To use Syscoin Core RPC without storing credentials in the repo:

export SYS_RPC_HOST="127.0.0.1"
export SYS_RPC_USER="your-user"
export SYS_RPC_PASSWORD="your-password"
python3 syscoin_tracker.py rpc-check
python3 syscoin_tracker.py sync-masternodes --csv network_masternodes.csv
python3 syscoin_tracker.py sync-top-wallets --max-blocks 1000 --batch-size 50 --json top-wallets.json
python3 syscoin_tracker.py sync-emissions --max-blocks 1000 --batch-size 50 --json emissions.json
python3 syscoin_tracker.py --nevm-rpc-url http://127.0.0.1:8545/ sync-nevm-emissions --max-blocks 1000 --batch-size 50 --json emissions.json
python3 syscoin_tracker.py verify-sentries --since-date "2026-04-14 12:30"

For always-on sentry node monitoring, run the watcher from the VPS that has local RPC access. The installer clones or updates the repo at $HOME/sysWalletTracker, writes a private .env, runs one sync, then installs a once-per-minute cron job:

SYS_RPC_USER="your-user" \
SYS_RPC_PASSWORD="your-password" \
SYS_RPC_URL="http://127.0.0.1:8370/" \
bash <(curl -fsSL https://raw.githubusercontent.com/bigpoppa-sys/sysWalletTracker/main/scripts/install_vps_cron.sh)

If the repo is private, clone it on the VPS with your GitHub auth first, then run the installer from that checkout:

git clone https://github.com/bigpoppa-sys/sysWalletTracker.git ~/sysWalletTracker
cd ~/sysWalletTracker
SYS_RPC_USER="your-user" \
SYS_RPC_PASSWORD="your-password" \
SYS_RPC_URL="http://127.0.0.1:8370/" \
./scripts/install_vps_cron.sh

If the VPS cannot authenticate to GitHub, install from the public Vercel bundle instead:

mkdir -p ~/sysWalletTracker
curl -fsSL https://syswallettracker.vercel.app/sysWalletTracker-vps.tgz -o /tmp/sysWalletTracker-vps.tgz
tar -xzf /tmp/sysWalletTracker-vps.tgz -C ~/sysWalletTracker
cd ~/sysWalletTracker
SYS_RPC_USER="your-user" \
SYS_RPC_PASSWORD="your-password" \
SYS_RPC_URL="http://127.0.0.1:8370/" \
./scripts/install_vps_cron.sh

Cron logs go to $HOME/sysWalletTracker/logs/static_snapshot_cron.log. The cron job uses a lock so a slow RPC check cannot overlap the next minute's run. Set SYS_TOP_WALLET_MAX_BLOCKS in $HOME/sysWalletTracker/.env to index top-wallet blocks during each cron run; leave it at 0 to only publish the latest existing top-wallet snapshot. SYS_TOP_WALLET_BATCH_SIZE controls how many blocks are fetched per RPC batch. Set SYS_TOP_WALLET_CLUSTER_MAX_BLOCKS to backfill common-input observations for research. New collateral-funding links are no longer added. Historical mixed edges are retained but are not used for public ownership attribution, and this job does not reset or affect the exact address-balance index. Set SYS_EMISSIONS_MAX_BLOCKS to backfill the Network Emissions index in chunks during the static cron run. The index reads each block's coinbase transaction, separates miner, sentry, and governance payouts, and subtracts RPC-reported transaction fees for the estimated issuance rate. Set SYS_NEVM_EMISSIONS_MAX_BLOCKS and SYS_NEVM_RPC_URL to backfill the NEVM side of Network Emissions. The NEVM index records the static miner reward, priority fees, and EIP-1559 base-fee burns, then folds the net supply impact into the same /emissions view.

verify-sentries compares exact 100,000 SYS candidates against Syscoin Core masternode_list outpoints. If RPC is only bound locally on a remote node, use an SSH tunnel or adjust rpcbind / rpcallowip carefully.

Ignore small outputs:

python3 syscoin_tracker.py report --min-sys 1000 --top 50

Follow large first-hop outputs one additional hop:

python3 syscoin_tracker.py follow --depth 2 --min-sys 1000 --limit 100

Custom Provider

Use another Blockbook instance:

python3 syscoin_tracker.py --blockbook-url "https://your-blockbook.example" sync

The default public endpoint is enough for tracking, but a private Blockbook instance is better for heavy polling or deeper multi-hop tracing.