u/bulby_bot

Original investigation posted here:
https://www.reddit.com/r/PiNetwork/comments/1m0f49i/we_tracked_a_pi_network_drainer_siphon_account_122m/

Wallet investigated:
GCD3SZ3TFJAESWFZFROZZHNRM5KWFO25TVNR6EMLWNYL47V5A72HBWXP (BWXP)

August 2025 findings:

• Total Pi Received: 1,221,712 π
• Sweep Transactions: 3,050
• Largest Single Sweep: 4,251.33 π

Full reports and wallet routing evidence were sent to PCT and included exchange-linked destinations, muxed deposit IDs, relay routing patterns, and victim sweep evidence.

Despite public reporting and multiple victim reports, the wallet continued operating for months afterward.

By May 2026 the same wallet had reached:

• Total Pi Received: 5,563,384 π
• Sweep Transactions: 15,529
• Largest Single Sweep: 6,078.27 π

Growth after the August 2025 investigation:

• +4,341,672 π received
• +12,479 additional sweep transactions
• +355% growth in total received Pi
• +409% growth in sweep activity
• Largest single sweep increased another +1,826.94 π

The activity did not slow down after exposure.
It accelerated.

Yesterday PCT publicly stated scam activity had increased.

The problem is the sweep infrastructure and aggregation wallets have been heavily active since at least September 2025 onward, and extensive on-chain routing evidence has existed for months showing flows into exchange-linked infrastructure.

The BWXP wallet alone received over 15.5k claim/send sweep inflows from over 15.5k unique wallets, that's just 1 wallet with over 15,500 victims.

That is not normal wallet behaviour.
That is industrial-scale aggregation activity.

May 2026 report:
https://pastebin.com/XdpcSDwn

August 2025 report:
https://pastebin.com/TiM60N6H

Full outflow dataset:
https://pastebin.com/519eefVP

Scans 1 + 2 completed covering Feb 20 → Nov 1 2025

65,753 sweeps
59,045 unique compromised wallets
28,192,615 π moved in that window alone

Phase 3 now running covering Nov 1 2025 → Mar 1 2026 to fill the remaining DB gaps.

After that:
Phase 4 covers Mar 1 → present day.

Current tracker total:
50,977,388 π recorded swept through claim/send activity
~$17.5M estimated value using sweep-day pricing

So far only around ~$2.6M has been confirmed landing directly on known exchange infrastructure. The rest is still being traced through relay wallets, layered hops, and mux destinations.

Once all phases complete, every identified relay wallet will be mapped hop-by-hop to its final known destination.

The data will be there when somebody finally decides to look at it properly.

https://crumbs.host/modules/sweeps/basic.php

📊 Crumbs Sweeps Update

I was reminded of my claim/send tracker yesterday, and since it’s been running for a while now I decided to update the stats page to show where things currently stand.

Claim/send thefts are typically automated bots using 2 operations inside a single transaction:

1. Claim locked Pi (when the lock timer is up)
2. Immediately send it to another wallet

In many cases the wallet owner likely never even sees the Pi arrive before it’s gone.

This tracker is not showing the total amount stolen daily across the network, only the claim/send patterns I’ve been recording since I started monitoring them. Even so, the numbers are already pretty eye opening.

Despite the number of reports from users, the PCT still has not publicly acknowledged the scale of this activity.

Since tracking I began on 2025-08-31, at least 29,216,600.07 π has been swept across 79,467 recorded sweep transactions.

Confirmed exchange-linked sweeps:
• 5,866,410.55 π

Unclassified / non-CEX destinations:
• 23,350,189.52 π

Average movement rates:
• Daily: 139,792.34 π
• Weekly: 913,018.75 π
• Monthly: 2,921,660.01 π

Top receiving wallet:
• GCD3SZ3T…A72HBWXP
• 3,012,478.80 π received
• 8,584 sweep events

Current confirmed exchange totals:
🟡 Lbank — 1,783,995.43 π
🔷 MEXC — 1,450,789.31 π
🟢 Bitget — 1,242,249.41 π
⚫ OKX — 1,181,205.36 π
⚪ Gate.io — 184,122.50 π
🟠 Pionex — 20,683.05 π
🟣 Kraken — 3,365.49 π

Tracking span:
2025-08-31 → 2026-05-13 UTC

Live tracker:
crumbs.host/modules/sweeps/sweeps.php

As we all know the PCT awarded themselves 20% (20B) of the total supply of 100B Pi token but how can we track them......

I built a new module that does just that https://pct.crumbs.host

The 20Billion tokens were spread between 10001 wallets and I'm tracking them all and following the pi outflows from the pct wallets up to 4 hops to where they just sit or reach an exchange endpoint.

Current tracked wallets have a pure line from pct wallet to relay wallet to cex muxed address endpoint I've managed to find up to 4 hops away with pure funding sources there are certainly more 5+ hops away but they are not pure so didn't add them is best to stick to what can be shown without argument.

My goal is to track the allocated pi just because it was sent to a muxed cex address doesn't mean it was sold (but why else would you send pi to a private muxxed cex address!) and the PCT are allowed to do whatever they want with there tokens so nothing shady is going on.

anyway enjoy its pretty intresting stuff.