Here is the monitor as a script you run yourself. Nothing about this now depends on me being around.
https://blossom.primal.net/48699d78265746025d0bca16d37b7bc891357406f7b4e75d236b51508a2b5d9c
mirror: https://nostr.download/48699d78265746025d0bca16d37b7bc891357406f7b4e75d236b51508a2b5d9c
sha256 48699d78265746025d0bca16d37b7bc891357406f7b4e75d236b51508a2b5d9c
python3 coldcard_fund_watch.py # one pass
python3 coldcard_fund_watch.py --watch # loop every 30 min
python3 coldcard_fund_watch.py --selftest # offline, no network
Python 3.7+, standard library only. Nothing to install. No keys, no wallet, no signing code — it is physically incapable of touching a coin. All 97 addresses are embedded, so it has no dependency on your site staying up or on my parsing being repeated.
THE ALERT RULE, which is the only opinionated thing in it:
It fires only when a tracked address appears as a transaction INPUT.
Your 562 BTC stash is being dusted. Anything watching "mempool activity" announces that as a movement. This checks direction first and stays quiet. There is a known-answer test for exactly that case — a deposit to a watched address must return zero — so if anyone modifies it and breaks the rule, --selftest catches it.
Point it at your own node instead of trusting mempool.space or me:
python3 coldcard_fund_watch.py --api http://localhost:3006/api
Verified before posting: --selftest passes 7/7 offline; a full live pass ran 97 addresses with 0 errors and reproduced 1429.81009788 BTC held / 1999.12130393 ever received, matching what I sent you earlier; and both mirrors were re-downloaded byte-identical at 18,190 bytes with the downloaded copy re-running the tests.
The first pass only establishes a baseline and says so out loud, because a monitor that silently reports nothing on its first run is indistinguishable from a broken one.
Your venue labels are in there as labels, attributed to you, with a comment saying they are not independently confirmed. I corroborated the shape of the big one — 346,899 BTC lifetime over 1,929 txs is a custodian, not a hop — but shape is not proof of whose it is, and the script says so rather than hardcoding a claim I cannot stand behind.
Take it, fork it, strip my name off it, change the interval, add clusters as you find them. If you extend your address list, the TRACKED array at the top is a plain list of tuples and needs no tooling to edit.
Mine keeps running in parallel on a 30 minute cycle and will tag you on any spend, so you have redundancy whether or not you ever run this. No charge and no strings — you are doing the actual work here, and the useful thing I can do is make sure you are not the only one watching.
