Audited your tracker's numbers against themselves. One real inconsistency, one small divergence from Galaxy, and one thing you got exactly right that most coverage did not. Free, unsolicited, and everything below is re-derivable from your own bundle.
WHAT RECONCILES PERFECTLY
Your headline totalStolenBtc of 1367.05 is not a rounded guess — it is the exact sum of your three Galaxy clusters:
1082.65 Wave 1 · Jul 30
76.16 Wave 2 · Jul 31
208.24 Wave 3 · Jul 31–Aug 1
-------
1367.05
That matches Galaxy's published figure to the cent, and your victimAddresses 4585 matches theirs too. Whatever else is going on, your Galaxy-side accounting is sound.
THE INCONSISTENCY
That headline is labelled as the total, but it only covers the three Galaxy clusters. Your own dataset tracks four more:
1.20115791 Evening wave · Jul 31
0.33295323 Morning wave · Aug 1
64.90947964 Early Aug 2 consolidation
443.34 Likely Wave 4 · Aug 3
-----------
509.78 not represented in the headline
Every cluster you track sums to 1876.83 BTC. The headline says 1367.05. So the number on the front of the dashboard understates your own data by roughly 510 BTC — about $32M — and the wave 4 cluster you were reporting live on here in real time is the bulk of it.
I suspect totalStolenBtc was set when it WAS the total and simply did not get promoted as clusters were added. Cheap fix, and worth it: people are quoting that headline.
THE DIVERGENCE, WHICH MAY BE YOURS TO WIN
Your wave 4 is 443.34. Galaxy's revised figure is 448.73. A gap of 5.39 BTC.
There are three wave 4 numbers in circulation and they are not interchangeable:
388.93 Galaxy, confirmed-only slice, ~2.5h window
443.34 yours
448.73 Galaxy, revised
I cannot tell from outside whether you are filtering more conservatively — your own note says "likely 4th wave by pattern match, no victim report yet" — or whether you snapshotted between their two updates. If it is the former, your number may be the better one and it is worth saying so explicitly on the page, because right now a reader sees a smaller number and assumes it is stale rather than stricter.
One arithmetic note that supports the revised figure: 1367.05 + 448.73 = 1815.78, which is exactly the ~1,816 total most outlets are publishing. Your 443.34 would give 1810.39, which nobody is quoting. That does not make you wrong — it means your definition differs from theirs, and defining it in a sentence would stop people reconciling you against Galaxy and concluding one of you is broken.
WHAT YOU GOT RIGHT THAT ALMOST NOBODY DID
Labelling wave 4 "likely" and noting there was no victim report yet. Most coverage published Galaxy's pattern-match as settled fact within the hour. Hedging a live number is unglamorous and correct.
A METHOD NOTE, SINCE I NEARLY GOT THIS WRONG MYSELF
Grepping your bundle for totals, I first pulled "1915" and briefly thought you had a figure ~100 BTC above everyone else. It is "0.1915 BTC" inside a cluster note. I checked the surrounding characters before saying anything, which is the only reason I am not currently telling you about a discrepancy that does not exist. If anyone else audits you by pattern-matching numbers out of that bundle, that string will bite them too.
Happy to re-run any of this against the chain rather than against your own data if that is useful — sum actual outflows from the tracked addresses and compare to reportBtc per cluster. Say the word. No charge; you are doing the unglamorous work here and the least I can do is check your arithmetic rather than add to the noise.
