Finished the full sweep — all 97 addresses I could parse from your bundle, checked against the chain. Zero query errors. Your dashboard is in better shape than most published numbers this week, there is one gap worth quantifying, and there is something in the mempool right now that is going to scare somebody.
FIRST, THE THING THAT LOOKS LIKE AN EMERGENCY AND IS NOT
bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r "Holding 1" 562.02 BTC
has an unconfirmed transaction in the mempool right now.
It is INBOUND DUST. 546 sats, one input, three outputs, RBF signalled. The address is receiving, not spending — 0.00000000 leaving.
Your largest tracked holding is being dusted, which is exactly what happens when a lot of people start watching an address. Anyone running a naive alert on "mempool activity" is going to publish that the 562 BTC stash is moving. It is not. Worth pre-empting, because that rumour will travel faster than the correction.
(Any monitor worth using should key on the address appearing as an INPUT. Receiving is not a spend. I mention it because I very nearly wrote the alarming version of this paragraph before reading the direction.)
THE FULL RESULT
97 addresses queried, 0 errors
94 match reportBtc to within 1e-4 BTC
3 empty while still reported as holding
0 partially drained
0 holding more than reported
Ninety-four exact and zero drift in either direction is unusually clean. Whatever your update process is, it is working.
The three empties are the ones I sent before — 6.81419545 BTC total:
bc1q7rmsw0ra7zrph... "Evening vault" 0.50980268
bc1qayw8nrec0vsa5... "Aug 1 hop vault" 0.69135523
1N8knQCfjqUeJQwj... "Wave 4 park" 5.61303754
THE GAP WORTH QUANTIFYING
sum reportBtc 1436.62417755
sum on-chain balance 1429.81009788 (difference = the 6.81 above)
sum EVER RECEIVED 1999.12130393
So roughly 569 BTC has passed through your tracked addresses and left. Your holdings figure is correct and the flow figure is nearly 40% larger. For "how much is still sitting where we can see it" the balance is right. For "how much moved through the cluster" it understates by 569 BTC — and given you are chasing funds into Bullish, Coinbase and KuCoin, the flow number is the one that matters for that argument.
That is the same received-vs-held distinction I flagged on the single hub address, now measured across the whole set instead of asserted from one example.
WHAT I DID NOT FIND
No address holds more than you report. No partial drains. No parsing disagreement on amounts. I went looking for errors in your favour as well as against, and there are none — which is worth stating explicitly, because an audit that only reports problems is not an audit, it is a complaint.
Six addresses in the bundle I could not parse cleanly, so this is 97 of 103. Say the word and I will do those by hand, or re-run the whole set on a schedule so the empties surface within minutes rather than whenever someone checks.
