CRUMBS BUILD HISTORY

PCT Monitor
Build Timeline

From CSV wallet snapshots to a VPS-powered Pi forensic monitoring system. This page records the build path of the Crumbs PCT wallet monitor, including the original subdomain.crumbs staging phase, the VPS API upgrade, historical movement tracking, and later migration toward dedicated PCT tooling.

Tracked Wallets
10,001
Original Host
subdomain.crumbs
Scanner Upgrade
VPS
Core Method
Verify
April 25, 2026

Initial PCT Wallet Tracking Experiment

The project began as a simple balance-checking tool for the 10,001 known PCT wallets. The goal was to track balances, detect movement, and make it easier to see where Pi was flowing without manually checking explorers.

https://subdomain.crumbs.host/latest.php
  • Python balance crawler created.
  • CSV snapshots generated from laptop scans.
  • Initial files included wallets_previous.csv and wallets_latest.csv.
  • Early scan missed around 8 wallets, then fixes were added.
  • Ideas already included Bubblemaps-style views and Track-and-Trace style tools.
April 26, 2026

First Balance Anomalies and DB Planning

A later scan detected 19 changed wallets with a combined net movement of only 0.0000010 PI. This triggered the first deep investigation into stroop-level drift, rounding behavior, and unexplained balance changes.

  • CSV compare logic became the first change detector.
  • MySQL storage was planned to replace CSV-only tracking.
  • Cron-based monitoring was introduced.
  • Hidden out-of-view database config was added for safer credentials.
https://subdomain.crumbs.host/cron/cron.php
April 27, 2026

First Live Feed Goes Online

The first live monitoring page was launched. It used cron scans to check batches of wallets and display confirmed balance changes.

https://subdomain.crumbs.host/live.php
  • 100 wallets scanned every 10 minutes.
  • Live balance change ticker added.
  • Cron log viewer created for debugging.
  • Debug links added to live and change pages.
https://subdomain.crumbs.host/cron/logview.php
April 27–29, 2026

Stroop Drift Investigation

Tiny balance differences were investigated using custom test pages and generated reports. The purpose was to determine whether the changes were real ledger movements, older transaction effects, or rounding artifacts.

  • Single-wallet debug pages were created.
  • Generated reports documented suspected anomalies.
  • Later scans showed the tiny drift was most likely rounding-related.
  • Genuine transfer detection continued to work correctly.
April 30, 2026

Public Node Speed Breakthrough

The scanner was upgraded to use public Pi Horizon/API nodes. This changed the project completely because full scans no longer needed to wait on the slower original route.

  • Public nodes were tested for latency, freshness, and reliability.
  • Working node lists and stability reports were generated.
  • Scan time dropped from 14+ hours to around 5 minutes.
  • Throughput reached roughly 40 wallets per second.
Old scan time: 14+ hours
New scan time: around 5 minutes

VPS Infrastructure Created

Shared hosting could not directly use the public node ports, so a cheap VPS was added. This became the scanning engine and API layer for the project.

  • Python crawlers moved onto the VPS.
  • JSON snapshots were generated server-side.
  • The shared host imported VPS output into MySQL.
  • The system became a VPS-to-database-to-dashboard pipeline.
http://vps./wallets
VPS Scanner JSON Snapshots API Endpoints Shared Host Cron Import MySQL Database Frontend Dashboard

`pctlive.php` Replaces the Early Live Page

The original live page was replaced with a cleaner PCT-specific live movement feed. Old links were redirected so existing links still worked.

https://subdomain.crumbs.host/pctlive.php
  • Cleaner live feed layout.
  • VPS-fed data pipeline.
  • Confirmed balance changes only.
  • Old live.php links redirected to pctlive.php.
May 1, 2026

Historical Operation Backfill Begins

The project moved beyond balance checking. A historical crawler began reading wallet operations from creation through recent activity.

  • Operations crawled for all 10,001 wallets.
  • In/out movement stored with timestamps.
  • External movement could now be grouped by day, week, month, and year.
  • Laptop handled heavy backfill while VPS handled ongoing updates.
pct_wallet_pi_movement_v2
May 2–3, 2026

Reliability Engineering

Public nodes were fast, but not always correct. Some returned stale or inconsistent data, so the architecture was changed to treat fast scans as discovery only.

This is also where one of the clearest similarities appeared. The engineering thought process behind this verification model was publicly documented during development, making it difficult to explain why the same wording and workflow later appeared elsewhere.

Confirmed balance changes only. VPS scans, Horizon confirms.
The phrase originated directly from this verification approach and was publicly used during development discussions and Discord logs at the time.

The idea was simple: public nodes were fast enough to scan all 10,001 wallets, but not trusted as the final source of truth. The VPS would detect candidate changes quickly, then Horizon would confirm them before the database updated.

Fast public node scan Candidate change found Official Horizon confirmation Database update only after verification

This became the key trust model of the system: speed from public nodes, truth from confirmation.

May 3–4, 2026

Exchange Flow Forensics

The tool began exposing structured movement patterns from PCT wallets into intermediate wallets and then toward muxed exchange deposit addresses.

PCT Wallet Relay Wallet Repeated Chunked Transfers Muxed Exchange Address
  • Repeated transaction chunks detected.
  • Relay wallets identified.
  • Direct muxed exchange sends discovered.
  • OKX and Gate-style destinations investigated.
  • 1 PI test-send behavior observed in some flows.

Financial Value Layer Added

Historical Pi prices were mapped against movement dates so outflows could be estimated in USD at the time they happened.

  • Daily movement totals matched to daily prices.
  • Launch-period exchange sends valued.
  • Direct muxed exchange sends became easy to summarize.
  • The history page became useful for reports and public explanations.

Interactive Investigation Tools Added

The dashboard became a working forensic tool rather than a static stats page.

  • Clickable wallets.
  • Operation drilldowns.
  • Wallet grouping under historical totals.
  • Explorer links.
  • Relay and mux tracing experiments.
  • Early multi-hop tracing logic.
Later Cleanup

Move From subdomain to Dedicated PCT Tooling

The early experimental pages lived under subdomain.crumbs As the PCT monitoring module matured, the work was reorganized into dedicated Crumbs/PCT tooling.

Early staging: subdomain.crumbs.host
Dedicated module: pct.crumbs.host
  • subdomain.crumbs acted as the original build and test area.
  • PCT pages became their own dedicated module by request.
  • The wider Crumbs site kept the same practical investigation-first design.

Short Timeline Summary

April 25: CSV wallet balance snapshots begin April 26: tiny balance changes trigger anomaly testing April 27: live.php launches with cron scanning April 29: real movement detection stabilizes April 30: public node scanning cuts scans from 14+ hours to around 5 minutes April 30: VPS API layer created using http://vps. April 30: pctlive.php replaces the original live page May 1: historical operation backfill begins May 2–3: pcthistory.php launches May 3–4: relay, mux, and exchange tracing added Later: subdomain.crumbs staging moves into dedicated pct.crumbs.host tooling
The Truth

Two Fingerprints Changed Everything

Similar layouts, dashboards, charts, and blockchain tools exist everywhere. That was never the real issue.

The real issue was two exact implementation fingerprints appearing together after the original Crumbs monitor had already been publicly built, documented, archived, and discussed in real time.

Fingerprint 1:

"Confirmed balance changes only. VPS scans, Horizon confirms."

This was not generic marketing text.

The phrase came directly from a real engineering workflow created during development of the original Crumbs monitor after solving a verification problem involving public node speed and Horizon confirmation accuracy.

On 04/02/2026, bulbybot publicly documented the workflow in Discord:

"Public nodes are much faster but cant be trusted as a source of truth so thinking check all 10001 with public then use pi node to confirm the results..."

The exact same phrase was later copied directly onto the Zyrachain monitor.

Fingerprint 2:

20,002,010,001

This number was an early manually-created placeholder value used before the real blockchain funding amount had been identified through Horizon.

The actual on-chain funding amount was later verified as:

19,999,931,800.0741014

Blockchain transaction values are immutable. Horizon returns the real transaction amount. The value 20,002,010,001 does not exist on-chain and cannot be produced through Horizon or public API calls.

The placeholder value was later corrected on the original Crumbs monitor after the real transaction amount was verified.

Fingerprint 2.1:

20,000,000,000

After public accusations began, the original placeholder was silently changed on the Zyrachain monitor to another manually-inserted value: 20,000,000,000.

That replacement value also does not exist on-chain and still cannot be reproduced through Horizon or API calculations because the blockchain funding amount cannot arbitrarily change.

This is why the issue goes far beyond "similar ideas" or visual design.

The evidence includes:

The full archived timeline, implementation fingerprints, Wayback Machine records, Discord logs, API verification, and public responses are documented separately.

Their Response vs Reality

The full documented comparison, archived screenshots, implementation fingerprints, API evidence, Discord logs, placeholder balance changes, Wayback Machine history, and timeline breakdown are now available here:

Full Incident Record

Who is really behind Zyrachain?
Why are they so bad at math?
Why do they lie in public when the truth is obvious?
Why say things that are hard coded are not hard coded?
Why did the placeholder numbers change after exposure?
Why do the API results still return the same impossible values?
What explanations were given publicly — and why were posts later deleted?
How far does the copied implementation actually go?
How many other devs has he stolen from and claimed its his own work?

For archived screenshots, Discord logs, API proof, Wayback Machine records, fingerprint analysis,
and the full documented timeline click the link!

→ Visit zyrachain.crumbs.host

The original PCT Wallet Balance Monitor is still here and actively maintained.

→ View Live PCT Monitor