u/bulby_bot

https://developer.paypal.com/crypto

"Supported cryptocurrencies

The following cryptocurrencies are supported for Pay with crypto and are listed in the PayPal Payments allow list. Each currency must be identified by its standard currency code"

no official announcement though but its there!

multisig exploit IMPORTANT update

I was checking the data and noticed some of the added signers were set incorrectly so letting 3085 compromised wallets owners still move the pi out on after the unlock ends

(a good bot is still needed to beat the scammers bot).

📊 QUICK STATS:

💎 Total wallets with full control still: 3085

🎯 Pi that could be saved: 1,269,639.91 π

📉 LOWEST AMOUNT LOCKED: 0.30 π

📈 HIGHEST AMOUNT LOCKED: 3,853.53 π

here is a brief explanation.

the majority of signers that were added in the exploit set thresholds to

"thresholds": {

"low_threshold": 2,

"med_threshold": 2,

"high_threshold": 2

},

this effectively locks the original owners ability to use the account as you need at 2 signer keys(or more if more were added) to do anything in the account and only the scammer has all the keys.

but i noticed that some of the signers were set to

"thresholds": {

"low_threshold": 0,

"med_threshold": 0,

"high_threshold": 0

},

meaning only 1 signer is needed to claim and send unlocked pi out of the account but as the wallet is still compromised the scammers bot will still take the pi on unlock unless you use a good bot to beat it.

any low and medium threshold with a 0/1 means the user still has the ability to claim and send locked funds.

good owner has functions <2

low_threshold: 1,

med_threshold: 1

bad owner has no functions >1

low_threshold: 2,

med_threshold: 2

unfortunately it is only

A total of 3085 wallets

with

A total of 1,269,639.91 π locked in them

out of the 110,646 that i have scanned that were hit with multisig exploit but its something.

if your wallet has been affected by the exploit check here

https://api.mainnet.minepi.com/accounts/YOUR_ADDRESS

the screenshot added shows you what you are looking for and that wallet in the screenshot has had 2 signers added but because they did the thresholds wrong the original user still has the ability to claim/send there lockups when they expire (use a good bot)

the first compromised wallet that could potentially be saved is

https://blockexplorer.minepi.com/mainnet/accounts/GB42F25PNDMUXNP3L27XXZNYFBRFIM4UR66DCAQID6VRK6KQTPIAZQOJ

it has a lock up that ends the soonest out of the failed exploited signers

2026-06-17 04:53:33 UTC with a total 928.3145636 Pi due to be unlocked

it is a previous sweep victim on 2026-05-01 22:20:58 they had 103.00 π stolen so if that's your wallet get in touch with a trusted good bot operator and try and be the first signer exploit victim to beat the scammers.

I have the list in chronological order of these wallets and the unlock times I'm debating publishing it.

please share this in your circles get the word out that all is not lost for these un-lucky pioneers

Just a theory based on my observations

It seems the core team quietly opened multisig on mainnet then closed it again as scammers noticed and quickly added a second signer to the compromised wallets they had

Look at the ops of a wallet connected to the jee6 scammers wallet

GCUP32D6PV6FUIHV5NRZHUJWT67WWPRFWEYAVENGAD3HSLRHTJ3ITVJ3

It sent 0.5pi to 1,267 addresses and each of those addresses set up multisig many of these wallets are known victim accounts of a claim send sweep theft and now the scammers have complete control of the wallets the victim’s can't send pi out of the wallets even if they could beat the scammers bot on the next unlock.

Example wallet

GCEGHACQTIYIKEBS5NGS4I4LF5FMUNXMZIBAC27BK7TS6246HY7OMYWC

was swept on 2025-04-27 23:49:18 for 467 pi

and has a lockup of 324.1343206 π that unlocks 2027-01-07 23:09 UTC (212 days) that they can't save due to multisig being added

Anyway this is what I observed today these multisigs were added 4 days ago and since yesterday creating a multisig is blocked.

I did a random check of 9 out of the 1267 addresses and all have multisig added with

GCSOLUCB46LIUPHBIWUA3ACO4J4BKJZHICDM7BQ7ZHNLSHLQGNVNI5K6

as the 2nd signer a non activated Stella compliant addresse.

Did the core team realise what was going on and block access to add multisig??

Crumbs AI is now live for testing.

https://crumbsai.crumbs.host/

Current tools include:

Wallet / TX Tools

• Wallet lookups with balances, lockups and activity summaries

• Transaction Track-N-Trace with hop analysis and exchange detection

• Vanity Pi mux generation

Try things like:

w <GADDRESS>

Returns wallet info, balances, lockups and more.

tx <TXHASH>

Returns a full track and trace report for that transaction.

vanity GBERCOOQNGWZHE6CTZYSYYNNWG3PUB45W7MMZOT7I3KXU3MC4C7USPRG YOLO

Result:

MBERCOOQNGWZHE6CTZYSYYNNWG3PUB45W7MMZOT7I3KXU3MC4C7USRVYHNZPGYYOLOZ74

PCT / Sweeps AI

pct summary

pct last cex send

sweeps summary

sweeps largest sweep

PCT analytics, sweep tracking, wallet lookups, transaction tracing and Pi blockchain data using natural language.

Expect bugs. That's why it's a test build.

If anyone feels like breaking it, let me know what you find.

So apparently some devs think you can copy someone's code, run it through AI, upload it, then claim it's completely original work. Wild strategy honestly.

Minor update maybe the end who knows!

He did reply to me on Telegram at first, same lies "we don't copy bro" "its math bro" but stopped replying after I pointed out that the "starting balance" number on his monitor was literally a placeholder value I invented during development before I found the real blockchain amount.

The math does not math. 20,000,000,000 ÷ 10,001 = 1,999,800.019998. Not 20,002,010,001. That number I made up before I found the exact number 19,999,931,800.0741014 which I rounded down because who wants all those decimals. I changed it after he ripped my code so he never knew.

That number does not exist on chain. It cannot be returned from Horizon. There is no API call that produces it.

After getting called out publicly he silently changed the number on his site except the replacement number is ALSO wrong and ALSO impossible to get from blockchain data. Which reinforces exactly what I said from the start, the values were hardcoded.

Now, Even funnier the workflow phrase I created during development "Confirmed balance changes only. VPS scans, Horizon confirms." is still live on his site right now above the new edited and still wrong number!

it's been 3 days with no replies after the math and blockchain records stopped matching the excuses.

So Anyway I built a full incident page with archived screenshots, API proof, Discord logs, timeline records, and chat history and used the zyrachain name because apparently that's ok to do and shiz and its already on wayback, google is crawling it soon when you search for zyrachain my page will be the first one that pops up looking forward to the memes showing up on image search for zyrachain!!

https://zyrachain.crumbs.host

Hope you enjoy the comic strip I added.
At this point you have to laugh.
My layout is trash and now someone is running broken code on a stolen version of it!

It was recently pointed out to me that someone had copied my code. No biggy, it happens, it's all public info, so I put out a cheeky post saying:

"They say imitation is the sincerest form of flattery... but this feels less 'inspired by' and more 'Ctrl+C Ctrl+V'. At least I've confirmed they're not scraping my live backend data, just apparently my entire design language... and not even a shout out."

They replied (since deleted) saying they have never copied anyone and that they "rebranded." Clearly they thought that existing since June 2025 gives them licence to copy others' work and claim it as their own. What they didn't know is that Crumbs has been around since August 2025 with the same branding, so that argument doesn't hold up.

I wasn't having that. I have full logs of the build and screenshots of the entire process start to finish.

The phrase that gave it away

Yes, anyone could independently build their own PCT wallet monitor after I had, but there were things that proved it came directly from my older module. Things you can't explain away as coincidence.

The most obvious was the wording: "Confirmed balance changes only. VPS scans, Horizon confirms."

That phrase came from a specific thought process I worked through and documented in Discord at the time:

"Public nodes are much faster but can't be trusted as a source of truth, so thinking: check all 10,001 with public then use the Pi node to confirm the results. There is not much PCT wallet action so the Pi node will run through the list fast enough for the short list of txs to confirm them before db updates."

That engineering decision produced that exact phrase. It doesn't flow naturally unless you had independently discovered and tested the same two-step verification architecture, and if you had you'd be able to explain it. They couldn't and didn't.

So I asked why their site had a phrase I had coined during my own backend work and was met with silence.

The hardcoded mistake that sealed it

I decided to call their bluff. I went through my old logs, gathered the screenshots, and put everything online. Anyone can check the full timestamped build history here:

https://pct.crumbs.host/build-timeline.php

I tagged them, asked to see their timeline, and was again met with silence. They deleted the messages claiming they hadn't copied anything.

Then I noticed something even more damning, a hardcoded error still live on their website.

The PCT starting balance on their monitor shows 20,002,010,001.00 pi. That number is wrong. It existed on my test build and I corrected it on May 11th after investigating the blockchain data. The correct figure is 19,999,999,800.00 pi.

So how do two independent developers both arrive at the exact same incorrect hardcoded number? That is not coincidence. That is a copy.

Between the identical layout and CSS, the hardcoded personal phrase, and a hardcoded mathematical error that only existed on my test build for a short window, the evidence is pretty damning. Still silence from them, despite having previously called me a liar and claiming they would never copy anyone's work.

The frustrating part

A simple reply after I first called them out could have been:

"Fair play, I liked what you built and used it as a base, should have given you credit, sorry."

I would have been fine with that honestly. My code and design are nothing spectacular, built to do what they do, no major thrills. But for someone to copy it down to the hardcoded errors, then lie and claim they would never do such a thing, when I have all the receipts, that is not on.

I'm an independent developer who builds tools for a hobby. To see someone try to take credit and potentially profit from that work, then deny it when I call it out, is genuinely frustrating.

Anyway. Rant over.

This is my longest rant on reddit ever follow the full saga on X (at)bulbybot

I kept names out of it so its reddit mod friendly but tbh they should be named and shamed grok knows!!

Original investigation posted here:
https://www.reddit.com/r/PiNetwork/comments/1m0f49i/we_tracked_a_pi_network_drainer_siphon_account_122m/

Wallet investigated:
GCD3SZ3TFJAESWFZFROZZHNRM5KWFO25TVNR6EMLWNYL47V5A72HBWXP (BWXP)

August 2025 findings:

• Total Pi Received: 1,221,712 π
• Sweep Transactions: 3,050
• Largest Single Sweep: 4,251.33 π

Full reports and wallet routing evidence were sent to PCT and included exchange-linked destinations, muxed deposit IDs, relay routing patterns, and victim sweep evidence.

Despite public reporting and multiple victim reports, the wallet continued operating for months afterward.

By May 2026 the same wallet had reached:

• Total Pi Received: 5,563,384 π
• Sweep Transactions: 15,529
• Largest Single Sweep: 6,078.27 π

Growth after the August 2025 investigation:

• +4,341,672 π received
• +12,479 additional sweep transactions
• +355% growth in total received Pi
• +409% growth in sweep activity
• Largest single sweep increased another +1,826.94 π

The activity did not slow down after exposure.
It accelerated.

Yesterday PCT publicly stated scam activity had increased.

The problem is the sweep infrastructure and aggregation wallets have been heavily active since at least September 2025 onward, and extensive on-chain routing evidence has existed for months showing flows into exchange-linked infrastructure.

The BWXP wallet alone received over 15.5k claim/send sweep inflows from over 15.5k unique wallets, that's just 1 wallet with over 15,500 victims.

That is not normal wallet behaviour.
That is industrial-scale aggregation activity.

May 2026 report:
https://pastebin.com/XdpcSDwn

August 2025 report:
https://pastebin.com/TiM60N6H

Full outflow dataset:
https://pastebin.com/519eefVP

Scans 1 + 2 completed covering Feb 20 → Nov 1 2025

65,753 sweeps
59,045 unique compromised wallets
28,192,615 π moved in that window alone

Phase 3 now running covering Nov 1 2025 → Mar 1 2026 to fill the remaining DB gaps.

After that:
Phase 4 covers Mar 1 → present day.

Current tracker total:
50,977,388 π recorded swept through claim/send activity
~$17.5M estimated value using sweep-day pricing

So far only around ~$2.6M has been confirmed landing directly on known exchange infrastructure. The rest is still being traced through relay wallets, layered hops, and mux destinations.

Once all phases complete, every identified relay wallet will be mapped hop-by-hop to its final known destination.

The data will be there when somebody finally decides to look at it properly.

https://crumbs.host/modules/sweeps/basic.php

📊 Crumbs Sweeps Update

I was reminded of my claim/send tracker yesterday, and since it’s been running for a while now I decided to update the stats page to show where things currently stand.

Claim/send thefts are typically automated bots using 2 operations inside a single transaction:

1. Claim locked Pi (when the lock timer is up)
2. Immediately send it to another wallet

In many cases the wallet owner likely never even sees the Pi arrive before it’s gone.

This tracker is not showing the total amount stolen daily across the network, only the claim/send patterns I’ve been recording since I started monitoring them. Even so, the numbers are already pretty eye opening.

Despite the number of reports from users, the PCT still has not publicly acknowledged the scale of this activity.

Since tracking I began on 2025-08-31, at least 29,216,600.07 π has been swept across 79,467 recorded sweep transactions.

Confirmed exchange-linked sweeps:
• 5,866,410.55 π

Unclassified / non-CEX destinations:
• 23,350,189.52 π

Average movement rates:
• Daily: 139,792.34 π
• Weekly: 913,018.75 π
• Monthly: 2,921,660.01 π

Top receiving wallet:
• GCD3SZ3T…A72HBWXP
• 3,012,478.80 π received
• 8,584 sweep events

Current confirmed exchange totals:
🟡 Lbank — 1,783,995.43 π
🔷 MEXC — 1,450,789.31 π
🟢 Bitget — 1,242,249.41 π
⚫ OKX — 1,181,205.36 π
⚪ Gate.io — 184,122.50 π
🟠 Pionex — 20,683.05 π
🟣 Kraken — 3,365.49 π

Tracking span:
2025-08-31 → 2026-05-13 UTC

Live tracker:
crumbs.host/modules/sweeps/sweeps.php

As we all know the PCT awarded themselves 20% (20B) of the total supply of 100B Pi token but how can we track them......

I built a new module that does just that https://pct.crumbs.host

The 20Billion tokens were spread between 10001 wallets and I'm tracking them all and following the pi outflows from the pct wallets up to 4 hops to where they just sit or reach an exchange endpoint.

Current tracked wallets have a pure line from pct wallet to relay wallet to cex muxed address endpoint I've managed to find up to 4 hops away with pure funding sources there are certainly more 5+ hops away but they are not pure so didn't add them is best to stick to what can be shown without argument.

My goal is to track the allocated pi just because it was sent to a muxed cex address doesn't mean it was sold (but why else would you send pi to a private muxxed cex address!) and the PCT are allowed to do whatever they want with there tokens so nothing shady is going on.

anyway enjoy its pretty intresting stuff.