Crumbs CRUMBS / incident record
CRUMBS · INCIDENT RECORD · MAY 2026

ZYRACHAINThe Hard Coded Parts Told On You

This page documents what happened after a cloned PCT Wallet Monitor appeared on Zyrachain's testnet. The developers were given multiple opportunities to acknowledge where the work came from. What followed was denial, deleted replies, contradictory explanations, quietly altered values, and eventual silence — once the evidence became impossible to reasonably explain away.

Zyrachain fraud exposed: The AI development pipeline showing stolen code fingerprints including 20002010001 placeholder and VPS Horizon confirmation phrase
Original ecosystemPiCrumbs → Crumbs (Aug 2025)
PCT module build startedApril 25, 2026
Key fingerprintsPhrase + Placeholder number
Admission givenNone
Number changed but wrongMay 25, 2026
Phrase changedMay 28, 2026
CRUMBS Style css changedMay 28, 2026

CRUMBS Did Not Start In May 2026

The Crumbs ecosystem has existed publicly since August 2025, originally at picrumbs.online, then migrated to crumbs.host around December 2025. The same dark terminal aesthetic, green-on-black colour scheme, and monospace design language have been present throughout — preserved in Wayback Machine archives before Zyrachain's monitor existed.

The PCT Wallet Balance Monitor was built from scratch starting April 25, 2026, with every development decision documented in real time across a Discord server. The full log exists. Every line of reasoning, every tool decision, every engineering choice that produced the monitor's structure, terminology, and data model is timestamped and preserved.

Zyrachain's PCT monitor appeared weeks later. Built in Next.js/TypeScript rather than PHP, but the dashboard structure, metric card order, column names, terminology, and two specific implementation details are identical — including one phrase coined during a specific Discord message, and one number that was never correct and only visible during a brief test build window.

"A Shoutout Would've Been Nice"

The similarities were obvious immediately. Same telemetry styling, same dashboard flow, same metrics ordering, same card structure, same green-on-black presentation. The original public response was restrained. At that stage a simple acknowledgement was all that was expected.

What came back instead was a denial — "we rebranded, it has nothing to do with yours" — and a claim that Dappify (which became Zyrachain) had existed since June 2025. The replies were deleted shortly after.

That claim created another problem.

If Dappify and Zyrachain had an established public ecosystem dating back to June 2025, there should be an observable public development trail: live archived pages, captured dashboards, historical UI evolution, or preserved testnet deployments.

The Wayback Machine shows the opposite.

The contrast matters.

PiCrumbs and Crumbs show visible historical progression preserved publicly across multiple captures. The monitor ecosystem evolved in public and can be independently verified through archived snapshots.

Meanwhile there are no archived captures showing an earlier Zyrachain monitor, no historical telemetry builds, no earlier public evolution trail, and no evidence of a comparable system existing before the Crumbs monitor work.

The Build, Documented In Real Time

Every decision made during the build of the PCT Wallet Balance Monitor was discussed in Discord and is preserved with timestamps. From the first Python crawler to the production monitor with VPS scanning, Horizon verification, CEX outflow tracking, and hop analysis. This is not a reconstruction. It is the original log, unedited.

Apr 25 11:55
First crawler running. Python script scanning all 10,001 PCT wallets. CSV snapshots. Balance anomalies noticed immediately — tiny movements with no corresponding transactions.
Apr 27 08:06
The stroop mystery. 4 stroops moved with no transaction on the ledger. Hours of investigation, a Word doc generated as evidence for ChatGPT, eventually concluded as stroop drift. The investigation mindset that produced everything that followed started here.
Apr 30 02:50
First forensic pipeline confirmed. PCT wallet → relay wallet → muxed address → exchange. ~2.78M PI moved in ~2 minutes, automated batch execution confirmed.
Apr 30 14:31
The VPS breakthrough. Public Pi nodes can scan all 10,001 wallets in under 6 minutes vs the previous 14+ hour cycle. Scan time dropped from 14 hours to 5 minutes. KEY EVENT
May 2 23:25
The phrase is coined. "Public nodes are much faster but can't be trusted as a source of truth so thinking check all 10001 with public then use pi node to confirm the results... the pi node will run though the list fast enough for the short list of txs to confirm them before db updates." This becomes: "Confirmed balance changes only. VPS scans, Horizon confirms." FINGERPRINT 1
May 3 17:14
pctbalances.php goes live at browolf.crumbs.host with the tagline hardcoded, starting balance showing 20,002,010,001 π as a placeholder, and the full monitor structure.
May 11 16:19
The placeholder is found and fixed. 20,002,010,001 π identified as wrong. Blockchain transaction traced. Correct figure found: 19,999,999,800 π. Manual fix applied. FINGERPRINT 2

@itinajnr (Junman.PI.π)

Zyrachain is not anonymous. The person behind it publicly associates with multiple Pi ecosystem projects. The denial came from this account publicly, and privately over Telegram. Their identity and public standing in the Pi ecosystem are directly relevant to why this documentation matters.

Two Things That Cannot Be Coincidence

Similar dashboards can happen. Similar tools can happen. Similar visual styles can happen. None of those are the point.

What does not happen naturally is two unrelated developers independently inventing the exact same proprietary subtitle phrase and the exact same incorrect hardcoded placeholder value.

Fingerprint 1 — The Phrase

"Confirmed balance changes only. VPS scans, Horizon confirms."

— Hardcoded subtitle on browolf.crumbs.host from May 3, 2026. Still present on testnet.zyrachain.org as of May 26, 2026.

This phrase describes a very specific two-step architecture: fast public VPS scanning to identify candidate changes, followed by Horizon API confirmation before writing to the database. It came from a specific engineering decision documented in Discord on May 2. There is no way to independently arrive at this phrase without independently building the same architecture and independently choosing the same words to describe it.

This challenge was issued publicly. No explanation was given.

Fingerprint 2 — The Placeholder Number

The PCT starting balance of 20,002,010,001.00 π was a temporary hardcoded placeholder. It was never correct. Never retrievable from Horizon. Never the result of any calculation. It was manually entered during development, identified as wrong on May 11th, and corrected. Zyrachain's monitor displayed this exact number. Their API returned it. It only changed after being publicly exposed.

Crumbs test build — original placeholder
20,002,010,001
Never correct. Manually entered. Corrected May 11.
Zyrachain — original value
20,002,010,001
Exact match. Changed only after public confrontation.
Zyrachain — after confrontation
20,000,000,000
Still wrong. A round guess, not blockchain data.
Crumbs production — correct figure
19,999,999,800
Verified from on-chain transaction. Corrected May 11.

The Phrase Was Never Properly Addressed

Most responses focused on the balance value — whether it was hardcoded, mathematically generated, or calculated differently. What was consistently avoided was the larger issue: the matching subtitle phrase, the matching telemetry wording, the matching dashboard structure, and the appearance of both fingerprints together.

"Confirmed balance changes only. VPS scans, Horizon confirms."

This phrase was never generic marketing copy. It described a very specific engineering workflow. The balance value alone could be argued. The combination of the phrase and the placeholder appearing together on an unrelated site was not something that could be reasonably explained away as coincidence.
May 22
"We rebranded. We don't copy anyone." — Dappify existed since June 2025 as an organisation. This says nothing about this specific PCT monitor, its phrase, or its placeholder number.
May 24
"We use Next.js, you use PHP. How are we copying you?" — The stack difference is explained by running the source HTML through an AI code conversion tool. The data model, field names, column headers, and terminology are identical regardless of language.
May 24
"Starting balance math is current price divided by total available supply. We don't hardcode — it's a math job." — This calculation does not produce 20,002,010,001. Dividing 20,000,000,000 by 10,001 gives 1,999,800.02 per wallet. No calculation produces the placeholder. Disproved by own API
May 24
Direct API proof produced. "startingBalance":20002010001 returned from their own live endpoint. Static. Not calculated. Their own server confirming the copied placeholder.
May 25
Starting balance quietly changed to 20,000,000,000. No acknowledgement. Also incorrect — a round guess, not the blockchain figure. The phrase remained unchanged.
May 25

The Numbers Changed

After the placeholder balance was publicly exposed, the live values changed. The problem for the denial narrative was simple: the original number should never have existed there, the replacement values were also incorrect, and the changes only happened after confrontation.

Their Own API Confirmed It

The claim that the starting balance was calculated mathematically was disproved by a direct call to their own live API. The value returned was static — not calculated, not from Horizon. It was the exact placeholder from the Crumbs test build, served unchanged from their backend.

API call — testnet.zyrachain.org — May 24, 2026
curl.exe -s "https://testnet.zyrachain.org/api/pct-monitor/summary"
-H "Referer: https://testnet.zyrachain.org/pct-wallet-monitor"

{"success":true,"data":{
  "walletsTracked":10001,
  "startingBalance":20002010001, // ← exact placeholder from Crumbs test build
  "currentBalance":14136733665.489769,
  "confirmedChanges":2937,
  "totalOut":-5865276335.510231,
  "netChange24h":144000023
}}

Note: every field name — walletsTracked, startingBalance, currentBalance, confirmedChanges, totalOut, netChange24h — is identical to the Crumbs PHP data model. The TypeScript interface in their public GitHub matches field for field.

You Can't Copy The Backend That Makes It Work

The layout was replicated. The terminology was replicated. The data model was replicated. What was not replicated — because it cannot be scraped from a webpage or converted by an AI tool — is the backend infrastructure that actually produces the data.

Crumbs PCT Monitor

  • Old balance recorded for every change
  • New balance recorded for every change
  • VPS scan → Horizon confirmation pipeline
  • Balance snapshot history since April 25
  • CEX outflow tracking with hop analysis
  • 3-hop relay chain tracing
  • Exchange routing confirmed via muxed IDs
  • Correct starting balance: 19,999,999,800 π

Zyrachain PCT Monitor

  • Old balance: null on every record
  • New balance: null on every record
  • No balance snapshot history
  • Change amounts only — no context
  • No hop analysis or relay tracing
  • Explorer shows 0 π for flagged wallets
  • Wrong starting balance (both versions)
  • Phrase still copied, still unexplained
The tagline they copied describes functionality they do not have

"Confirmed balance changes only. VPS scans, Horizon confirms."

— Still present on testnet.zyrachain.org as of May 26, 2026. Their monitor shows null for old and new balances on every record. There is no Horizon confirmation step. There is no VPS scan. The phrase describes an architecture that does not exist in their implementation.

Independent Conclusions

The evidence was assessed independently by multiple parties who reached the same conclusion without being led there.

Grok — asked cold, no prompting

"This is a classic case of copying someone else's work (including UI/phrasing), inheriting their bug (hardcoded or cached wrong value), then quietly patching it while denying it. The 'independent math' excuse fails when the number only changed after public exposure of the mismatch. Bulbybot has receipts."

— Grok, May 25, 2026
Claude (Anthropic) — reviewed all evidence independently

"The order and terminology are identical while the underlying code language differs. That is consistent with the original HTML being processed through an AI code conversion tool. The field names, column headers, metric card order and crucially the hardcoded wrong number all came from the Crumbs PHP source."

— Claude, May 2026, after reviewing all submitted evidence

DumbDev Copied The Wrong Dev’s Code

(Story based on real events)

A documented meme investigation covering the cloned PCT monitor, copied implementation fingerprints, API evidence, placeholder edits, panic patches, deleted replies, and the excuses that followed.

Includes archived screenshots, Telegram conversations, API responses, blockchain verification, placeholder edits, timeline records, and implementation fingerprint analysis.

→ Visit zyrachain.crumbs.host

This Became Bigger Than A Clone

The copy itself was not the issue that turned this into a documented record. People build on others' work. That is normal. A shoutout, an attribution, an honest "I built on top of what you made" — any of those would have ended this before it started.

What created this page was the denial. Claiming "we don't copy anyone" when two specific implementation fingerprints — one a phrase coined in a Discord message at 11:25pm on May 2nd, one a number that was never correct and never publicly accessible after May 11th — are sitting live on your website is not something that holds up against a timestamped build log.

Independent developers operate on reputation and trust within the communities they build for. Taking work without credit is one thing. Taking it and then calling the original developer a liar when they ask for acknowledgement is another.

The build history was documented before any of this happened. The evidence existed before it was needed. This page exists because acknowledgement was repeatedly refused after it became impossible to reasonably deny.

What was asked for

"Fair play, I liked what you built and used it as a base — should have given you credit, sorry."

— The response that would have ended all of this before it started. Never given.
The Story So Far