Every transaction we can see, seed to destination.

The final two rows agree to the atomic unit, and they were always going to. The end-wallet total is defined as twice each ladder’s top rung, so seeds plus created minus leakage can only land on it. That confirms the arithmetic is consistent. It is not independent evidence that the amounts are right. The evidence for those sits one level down: each of the 46 doubled amounts was recovered from its own transaction and tested against the chain, with a control at one atomic unit either side.

18,886,517.3 is what came from nothing less the burn, and it is the right figure only if the burn came from these wallets, which nothing on chain shows. 18,991,870.8 is the total sitting in those wallets after the burn. The 105,353.5 between them is almost entirely the later ladders’ starting balances, which were paid out of the previous ladder’s proceeds and are therefore already counted once inside the created figure. Only 9.9 DERO of it ever came from outside. For any argument about what the exploit added to the supply, the first number answers it; the second counts the same coins twice.

The 20 apparent breaks are bridged by 36 ordinary transfers, found by walking the blocks between the rungs, with every amount recovered from the transactions themselves. The 5,556.1 total is measured. Its breakdown is not: 4,307.6 is change still sitting in wallets, 1,248.4 sat in wallets that a doubled debit drove below zero, and fees account for 0.09922, being 121 atomic units on each of the 82 transfers. Those three come to 0.00484 more than the measured total, which is exactly four fees, and that gap is not resolved here. Which individual links kept change and which drove a payer below zero needs per-wallet balance analysis that nobody has run. Nothing was destroyed in the overdrawn case: DERO adds a balance change unconditionally, with no underflow check and no burn, so an overdrawn account carries a negative balance more like a debt than a loss. It is counted here as money that left the ladders and never landed anywhere useful. None of it reached the exchange deposit described below, which was mined at block 7,471,517, roughly 11,400 blocks before ladder 3’s first rung at 7,482,913. Money cannot move backwards in time.

The amount is not a guess, and the test is one anyone can run. In these older transactions the amount and its blinding factor sit together in a single public commitment, so proposing an amount fixes the key the attached payload was encrypted under. That makes a candidate testable without any wallet key: subtract amount × G from the on-chain commitment to recover the blinder, take Keccak256 of its compressed form, derive the payload key from that and the ring member’s public key, and decrypt. The right amount yields a canonical, well-formed payload. Wrong ones yield noise. In transaction dd095ee722bf4126c50f281261b72933e1495ba9c2e47f35069e8e00d22dce55 at block 7,471,517, 408,774.564 decrypts cleanly. Twenty thousand nearby wrong values do not, and neither does the same figure one atomic unit higher or lower. Every amount in the transaction table below was recovered the same way. What it decrypts to is a routing tag, the sort of per-customer deposit identifier a service issues so an incoming payment lands in the right account. That, together with a receiving address registered years before any wallet in this operation and the same identifier repeated across both transfers, is the most that can honestly be said. “Exchange or similar service” describes a shape. It is not an identification. Nothing on chain attaches a brand name to it, so nothing here names one, and the tag itself is not published because it identifies an account.