---
name: ghostdotenv-wallet
description: The 10 Sep 2026 hunt for X caller @ghostdotenv ("ghost.env", 1,305 followers, "300k to 45M" MOO poster). Wallet found and verified by five timestamp matches; what his book actually did on MOO (round-tripped, not held), and the fingerprint method with the router trap. Read on any ghostdotenv, ghost.env or "who called MOO at 300k" question.
sources: [cowork]
aliases: [ghostdotenv, ghost.env, ghost-env, mooltiple]
---

# @ghostdotenv wallet hunt, 10 Sep 2026
- [stated] Ben pasted the 10 Sep post "300k to 45M & counting. Whats the MOOLtiple on that? $MOO" and asked to find his wallet from the tokens he mentions and the timestamps, "buying Moo at 300k market cap and still holding".

## THE WALLET: `0x5c54382981bdf5276912a68c1d1a15a5354cc6a0` (EOA, 1.02 ETH, ~192 token legs since 12 Jul)
Verified by post-to-trade timing, all UTC:
| his post | trade in the wallet | gap |
|---|---|---|
| 28 Aug 05:33 "$GLIZZY lmao. 1M easy" | +4,972,111 GLIZZY 28 Aug 05:31 (sold 05:45) | 2 min |
| 3 Sep 02:49 "calling bottom on $nudes" | +870,423 NUDES 3 Sep 02:43 | 6 min |
| 4 Sep 14:06 "I'm back in memory-cow-moo" | +784,335 MOO 4 Sep 14:01 | 5 min |
| 8 Sep 17:18 "adorable $astro gamble play" | +4,629k astro 8 Sep 17:16 | 2 min |
| 31 Aug 23:35 "I GAVE YOU THE BLUEPRINT AT 370K" | first MOO buys 23 Aug 20:13 and 20:20, 3,777,647 MOO at ~$0.00037 = ~$370k cap, ~$1,400 | exact cap match |
Also AI bought 22 Aug 01:05 ("August 22nd I was running the RH cycle"), MICRODUCK 29 Aug 16:48, INCEL 31 Aug 22:56, HOTDOG 3 Sep 01:55.

## WHAT HE ACTUALLY DID ON MOO (30 legs). He did NOT hold 300k to 45M.
- Bought 3.78M on 23 Aug (~$370k cap), then in and out six times: sold 1.89M 25 Aug, rebought, sold 2.71M 28 Aug, rebought, sold 30 Aug, rebought 30 Aug (1.7M), **sold everything 1 Sep 00:32 to 05:15 at roughly $20M to $25M cap (about 60x on the pieces he still had)**, out for three days, rebought 784k on 4 Sep 14:01 (~$14M), sold and rebought 7 Sep, **sold ~575k across 8 to 9 Sep at $30M to $40M**. Holds **62,424 MOO (~$2,400) now**.
- Ticket size throughout: $1,000 to $5,000. "I'm not a big KOL" is accurate. The 300k to 45M line is the coin's move, not his position.
- Style: flipper. HOTDOG bought 3 Sep 01:55 sold 22:11 same day; NUDES sold 4 Sep; INCEL sold 3 Sep; FATCOIN, LEGS, PENNY, DOUGH, NOTHING, SUPERCOINS, BANKLESS, PROLOGUE all round-tripped within hours. "Don't sell" posts to holders while his own wallet sells the resistance he tells them not to sell (7 Sep 14:00 post; 7 to 9 Sep sells).
- Solana side (STONK, OTC, NASDUCK) not resolved; he posts an Axiom referral link, so that book is on Solana and separate.

## Verdict for copy-trading: NOT a hold-through source. Useful only as an early-entry timing signal (he was in MOO, AI, GLIZZY, NUDES, astro minutes before or after posting), never as a conviction signal. Do not add to the strong-trader fleet; his exits contradict his posts.

## Method that found it, and the trap
- Fingerprint: for each token he named, pull Transfer logs in the window around the post, keep transfers FROM the token's pools / PoolManager `0x8366a39cc670b4001a1121b8f6a443a643e40951`, collect recipients, intersect across tokens, then `eth_getCode` to drop contracts and `balanceOf` to check holding.
- **TRAP: on Robinhood Chain most buys are delivered by ROUTERS, not by the pool.** The first pass counted only pool-to-wallet transfers and the "6 of 6" list was entirely routers and relayers (`0x8f10b468b06c6fd214b65f87778827f7d113f996`, `0x39b38686a19836ac10162c490e4558e120cbbe5f`, `0x8876789976decbfcbbbe364623c63652db8c0904`, `0xe492912f37c2a4eca45d42dc67548f4c6cd7ce2b`, `0x09ad820aac5779683b481c4674208a4e1b024afa`, `0x2ca37ff95caf25366ef16fc2e655b78a165d125f`, `0x6e2a35a7ad683cf634d91492d73bb7ff774c6919`, `0x5a705de8982235a7fa45bb83dcacf03a211389c7`, `0xbdbae060cbab0e9cfe802a7513dd5ecb36cda6c3`, `0x1521027b665fa38fa4a642991607ad708376dd7b`, `0xb300000b72deaeb607a12d5f54773d1c19c7028d`). Add those to the "from" set on the second pass and the real EOAs appear. Saved in /home/claude/rh/ghost/routers.json.
- **Second trap: sniper bots match every window with dust sizes** (`0xca5b3bbb368db39d223a9fa57a577f9a98a03638` etc., $2 buys seconds after each launch). Rank by size and by post-to-trade gap, not by match count alone.
- `eth_getLogs` errors "exceeds limit of 10000" on hot launches; chunk down to 500 blocks, never floor the step at 20,000.
- Address-less `eth_getLogs` (topic filter only) over 47M blocks does not finish in 10 minutes; use Blockscout `tokentx` instead. **The container is WAF-blocked, but the same URL opened in Chrome on the Mac returns JSON, and `javascript_tool` fetch on that origin paginates it** (`page=`, `offset=1000`). Output must avoid "@" and "limit=" or the tool blanks it.
- `pkill -f` with the script name in the same bash command kills the shell (exit 144). Same trap as the ssh one in [[pullback-comeback]].
- Files: /home/claude/rh/ghost/ (tweets.json, buy_*.json, buy2_*.json, cands2.json, buyers.py, rebuy.py).

## HIT RATE, scored 10 Sep 2026 (every leg priced on GeckoTerminal hourly candles, 22 real positions since 22 Aug)
- [stated] Ben: "how many coins, how good is his hit rate? ... is he a good picker?"
| coin | first buy | put in | took out | best in 7d | he captured | held |
|---|---|---|---|---|---|---|
| AI | 22 Aug at ~$18M cap | $3,683 | $18,347 | 6.5x (17.8x in 30d) | 5.0x | 7 days |
| MOO | 23 Aug at ~$460k cap | $39,952 (all rebuys) | $67,750 + $2,413 held | 14.6x (96x in 30d) | 14.3x on the first tranche, 1.76x on all capital cycled | in and out 8 times |
| INCEL | 31 Aug | $4,089 | $5,664 | 7.7x | 2.6x | 65h |
| NUDES | 3 Sep | $8,549 | $10,289 | 3.5x | 1.2x | 24h |
| FATCOIN | 3 Sep | $5,667 | $6,418 | 5.5x | 1.1x | 3h |
| MICRODUCK | 29 Aug | $4,492 | $4,225 | 2.9x | 0.94x | 48h |
| PROLOGUE | 30 Aug | $7,065 | $5,531 | 2.0x | 0.78x | 2h |
| HOTDOG | 3 Sep | $14,309 | $13,490 | 1.5x | 0.94x | 20h |
| BANKLESS, tree, SUPERCOINS, PEPONS, VAVA, astro, PENNY, DOUGH (rug, -95% in 3 min), TRIPLET, LEGS | | $9,900 total | $6,800 | none above 2.4x | 0.05x to 1.0x | minutes to hours |
GLIZZY, KARMA, Rabbit, NOTHING: bought and sold within minutes, candles unusable, treated as scratch.
- **Totals: ~$99k cycled, ~$43k net profit. $45k of it is MOO plus AI; the other 20 positions net about -$2k.** Wins 5 of 20 priced positions.
- **Picker score: 7 of 20 picks went 2x+ within 7 days of his buy (35%), 4 went 5x+ (20%).** Against the chain's blind base rate (9% ever 2x, 2.75% 10x in [[pullback-comeback]] v4) that is a real edge, and every pick was posted publicly before or within minutes of the buy.
- **Holder score: bad. Average capture on the winners is 1.1x to 5x against 3.5x to 96x available.** He sells inside a day on everything except MOO and AI, and on MOO he re-entered 4 Sep at $14M and 7 Sep at $25M, so his own average MOO cost is ~$0.004, not $0.00037.
- **Read for Ben: good early-entry signal, terrible exit signal.** Copy his entries on LONG-ecosystem names (his two big wins were both LONG coins he sat in for a week), never his exits, and ignore his "don't sell" posts because his wallet sells into them. Ticket $300 to $15k.

## 12 Sep 2026 RE-VERIFICATION. Wallet CONFIRMED by a sixth, independent match. But it is now EMPTY.
- [stated] Ben: "Check the OX Ghost wallet alert with his latest posts and see if we really have the correct wallet. Check the timestamps, his replies, the stuff that he's talking about, and the timing."
- **THE DECISIVE NEW MATCH, and it is the cleanest one yet: MOTH.** The wallet bought 5,865,648 MOTH `0x7db66154fbe0f046d0b3be719758d97dea52d90c` (token NAME "Moth Interface") at **11 Sep 19:20:22 UTC**, then he replied to **@mothinterface** at **19:21:51 UTC** ("did we kill a moth for this I'm not smart tell me"), then bought twice more at 19:23:37 and 19:23:40. **Gap 89 seconds, on a token whose market cap is $2,618.** Nobody else on the chain was buying that coin in that minute. This is a new coin, not in the original five-match set, so it is a genuine out-of-sample confirmation.
- Full recent ledger (topic-filtered eth_getLogs, 3.6M blocks, 20 legs, all through the v4 PoolManager `0x8366a39cc670b4001a1121b8f6a443a643e40951` so they are his own swaps): 8 Sep 17:16 to 18:12 sold ~574k MOO in six clips (~$14k) and round-tripped astro; 9 Sep 08:39 sold 109,713 MOO; 11 Sep 07:23:49 received 1,633,699 RECEIPT `0xb97d9e5ad6244d27588fe0a624a8c78e512934ee` and sent all of it back out 19:19:20; **11 Sep 19:19:04 sold the last 62,424 MOO**, which is EXACTLY the balance recorded in the 10 Sep hunt above, so the book reconciles leg for leg.
- **HE HAS LEFT ROBINHOOD CHAIN. The wallet holds $138: 6.78M MOTH ($18), one SPCX ($120), dust PONS/MEME/ChatGpt, and 0.0000974 ETH.** It was 1.02 ETH on 10 Sep. That matches his own post of 11 Sep 06:40 UTC: **"3k -> 20k on RH, then 20k -> currently 185k on SOL."**
- His 9 to 11 Sep posting (145 posts, 69 of them replies) is **almost entirely Solana / stonk.fun**: $STONK `6GmAFSYs4gk3FDao5FzzySQpPZaWsa4rUJHacpMpUNgx` in 23 posts, $OTC, $USELESS, $BTC (the cat) `E4Ap4icMLwKot8rkkTbq5JkS5kZxt5XCE3yfxbzYBjHx`, $RUSH `SATqS9DYpLQsM2z51P4QCoqJRHa5wboV4qjJerJRUSH`, `5ZfFmbHzXuhw17e73NGZSHwiyULmybb4azTXCH4U8sDw`. **His only Robinhood Chain references in three days are MOO as a legacy winner** (9 Sep 23:12, 10 Sep 07:23, 11 Sep 15:26), posted while this wallet was selling the last of it. Same "posts nostalgia while selling" pattern the 10 Sep hunt recorded.
- **11 Sep 20:11 UTC he announced joining @fomo with a SEPARATE new 4.5k account**, self-described as "significantly higher risk". So his flow is now split across Solana plus a fomo account, neither of which is this wallet. Followers now 1,402 (was 1,305). No post anywhere says he was doxxed or changed wallets; the move is a capital rotation, not evasion.
- **CONSEQUENCE FOR THE GHOST ALERT BOT: the wallet is right and the bot is nearly pointless.** It can only fire on $138 of dust. To keep the signal, the bot needs his SOLANA wallet, which is still unresolved (he posts an axiom.trade/@cmon referral link, so that book is on Solana). Told Ben; awaiting his call on whether to hunt the Solana wallet or retire the bot.
- Method note worth keeping: a KOL's reply to a PROJECT'S OWN ACCOUNT is a better wallet fingerprint than a reply to a person, because the project account pins the exact token, and a micro cap under $5k makes the match statistically unique. Search `from:<handle>` replies for @handles that are also token names.

## 12 Sep 2026: HIS SOLANA WALLETS FOUND. [stated] Ben: "Yes, find his other wallets."
**THE METHOD THAT CRACKED IT IN ONE CALL, and it is now the first thing to try on any cross-chain KOL: the RELAY BRIDGE API indexes by sender AND returns the destination address on the other chain.**
```
https://api.relay.link/requests/v2?user=<evm or solana address>&limit=50
```
`recipient` at the top level is the destination address; `data.inTxs[0].chainId` and `data.outTxs[0].chainId` give the route. **Relay's chain id for SOLANA is 792703809**, Robinhood Chain is 4663. 21 requests came back for his RH wallet and the Solana side fell straight out. No GMGN, no browser, no key. This beats fingerprinting by post timestamps, which took a full session on 10 Sep.

### WALLET 1, the main book: `Hz8535i7KtnUPFLQxXAJRvwVgbCeLi2sxnKhDbTXxvVo` (Solana)
- **10 bridges RH -> Solana into it (29 Aug to 8 Sep), and it is the SENDER on 8 bridges Solana -> RH (22 to 23 Aug, 4 Sep).** So it funded the Robinhood adventure and took the money back out.
- **PROOF, a double match inside one post, both halves in order:** 10 Sep **04:41:41 UTC sold 762,535.92 $PUMP** `pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn`, then **04:41:50 UTC bought 246,680.62** `MukLDtJ8Cx9DxLbeyLRSWPSposTMWuwHANbuaudpump`, then at **04:47 UTC he posted "I just sold half my $pump bag and bought solana:MukLDtJ8Cx9DxLbeyLRSWPSposTMWuwHANbuaudpump @ 8M mcap"**. Same two mints, same order, 5 minutes 10 seconds before the post.
- Live now: **80 non-zero token positions, last tx 12 Sep 04:18 UTC, only 0.005 SOL idle.** Holds `6GmAFSYs4gk3FDao5FzzySQpPZaWsa4rUJHacpMpUNgx` ($STONK, 96,901), `Dz9mQ9NzkBcCsuGPFJ3r1bS4wgqKMHBPiVuniW8Mbonk` (185,260), `SATqS9DYpLQsM2z51P4QCoqJRHa5wboV4qjJerJRUSH` ($RUSH, 53.30, the coin he said on 10 Sep 20:35 he would stake), `B3ZmftMo5Q5PVuipeCZAZhMLgbdaVD4zksCHtnJyRfVX` (2.40M, the largest), `J8qD8ETU6R1oPoYUMKZzPgd6vR5hBwKdpc6zJtPkpump` (1.45M), `Cj6p8owZJ4PBkuetyib2rgrsMgDMAHKYqAVZ5USTyMjV` (1.26M).
- Activity 1,000 signatures back to 9 Feb 2026; per day: 4 Sep 79, 6 Sep 23, **7 Sep 151, 8 Sep 83**, 9 Sep 20, 10 Sep 24, **11 Sep 87, 12 Sep 28 by 04:18**. He trades in dense bursts and there are trades inside EVERY one of his eight dated post windows.
- Only 3 of the 14 coins he named in three days are still held, which is the flipper pattern already on file, not a mismatch: he closes token accounts on exit so sold positions vanish from the holdings list entirely.

### WALLET 2, the new fomo account: `A3o9MC2cAsCvm56jKq3QcyF4452YLCMqjjCrkajSsku` (Solana)
- Received the **final two bridges out of Robinhood Chain, 11 Sep 19:35:34 and 19:36:06 UTC**, which is 16 minutes after he sold his last MOO and bought MOTH on the RH wallet.
- **11 Sep 19:36:51 it spent 4,466 USDC on 2,120,472.58 of `6CsmCtDAhRcbp3G4KiinKC2JjLJ9BpR7isqcgZefqLym`, and at 20:01 UTC he posted "bottom." about that exact mint. 24 minutes.** Then at **20:11 UTC he announced "Now starting with 4.5k on FOMO"**. The 4,466 USDC IS the 4.5k. Wallet 2 is the fomo account.
- It is live: its reward ATA `F3qnSwx5JEWBywKFGtb8zUAXvR2DiuLrezzvXgoUZ1a1` (mint `7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs`) takes an inbound roughly hourly, newest **12 Sep 04:11:38 UTC**, paid by `5KXDF6QnqhBj72hDtJNkkpFaQVUfbFXNybMsp3DiK6tD`, the stonk.fun holder-fee distributor already on file in [[zcat-early-buyers]].
- **SOLANA GOTCHA THAT COST A WRONG READ: `getSignaturesForAddress` on an OWNER misses inbound token transfers, because a transfer to an ATA puts the ATA in accountKeys, not the owner.** Wallet 2 looked like 3 lifetime transactions; querying its ATAs gave 24. Always enumerate `getTokenAccountsByOwner` and pull signatures per ATA.
- Third address seen once as a Relay sender, May 2026, unresolved and probably not his: `0xb26b207de8478b85db7951e3ca3f39f2a6f5dad5`.

### Other verified sightings in the post windows
11 Sep 21:43:52 bought `MqQscc2zkrLFm2PahR1QFzr4o1EnsStnkeWvdumGALL` 8 seconds before his 21:43 "Holy it's working" post about `ASoQZA3Dee2HU34Vwx3b5SAtTaczJtZcyx1T413nDALL`; both mints carry the same "ALL" vanity suffix, so he was trading that launchpad's coins in that minute. 11 Sep 20:33:36 bought `DKNGQFNGQmoBdXSRGKJ8tTu7uPDasw5JDcfMmWniNfow` 7 minutes before the "CdAoD87k... I'm in" post.
Files: /tmp/fs/ghost/ (relay.json, relay_rows.json, sol_sigs.json, sol_held.json, counterparties.json, legs.json).

## 16 Sep 2026: HE IS BACK ON ROBINHOOD CHAIN, ON A DIFFERENT WALLET. THE BOT WAS WATCHING THE WRONG ADDRESS.
- [stated] Ben: "I haven't received any OX ghost alerts recently... Double check if the wallet that we have for him still aligns with these recent buys." He pasted three of ghost's **subscriber-only** X posts (PRM, CEREBRO, INVEST) plus the GHOST ALERT Telegram screenshot.

### THE NEW WALLET: `0xa2f64ede5fb760498bc500306b3833c479e34211` (EOA, nonce 744, 0.031 ETH)
Proven by three post-to-trade matches on posts that are **behind his paid subscription**, so nobody outside could have front-run them. All Bangkok time:
| his post | trades in the wallet | gap |
|---|---|---|
| 14 Sep 03:48 "Put in a starter position on PRM" | **9 buys, 03:37:43 to 03:46:54**, 1,434,522 PRM total | last buy **1 min** before |
| 15 Sep 05:08 "Cerebro ... put in a stress free chip" | **4 buys, 05:04:15 to 05:05:47**, 2,004,879 CEREBRO | last buy **2 min** before |
| 15 Sep 08:35 "Got a tip from sub @Flynn_howitt, INVEST" | buy 08:31:38, 121.85 INVEST | **3 min** before |
- **TIMEZONE PROOF, and this is the reusable bit: the screenshots' post times are BANGKOK, not the chart's UTC-4.** Settled by pricing, not by assumption: the INVEST screenshot shows $8.3125, and INVEST only traded near $8.31 in the 15 Sep 08:00 BKK candle (o 9.204 h 16.631 l 6.556). The UTC-4 reading would put the post at 19:35 BKK where INVEST was 4.99 to 6.54, impossible. **Always date a pasted screenshot from the price printed on it before trusting the clock on it.**
- INVEST `0x4DDE75D857c729B7668e466667EB34A5CAF5a104` has **9 decimals, not 18** (supply 65,744.91). An 18-decimal assumption prints every leg as "+0" and the wallet looks like a non-buyer. **Read `decimals()` before any per-leg amount.**
- Style unchanged, flipper confirmed: INVEST bought 08:31:38, **sold 09:26:50** (55 min), rebought 09:40:13, sold 19:02:24. He also added PRM again 15 Sep 08:57.
- **Live RH book 16 Sep 18:50 BKK: 3,000,246 PRM ($31,833), 160,118 CEREBRO ($662), 0 INVEST, 0.031 ETH. Total ~$32,500.** Much bigger than the $300 to $15k tickets recorded in the 10 Sep hunt.

### CAVEATS, stated rather than hidden
- **No on-chain link between the new wallet and the old one.** Zero direct transfers between `0xa2f64ede5fb760498bc500306b3833c479e34211` and `0x5c54382981bdf5276912a68c1d1a15a5354cc6a0` across PRM, CEREBRO and INVEST logs. Relay shows the new wallet bridging once to a **third Solana address `9cgtw9Dt5UgmSLnur3wcyGEw2TpiohWWHz2UCBoTvpTW`** (07 Sep), not to his known `Hz8535i7...` or `A3o9MC2c...`. Its Relay history runs back to **14 Aug**, so it is probably a wallet he has always run in parallel, not a migration.
- The identification rests entirely on the three timestamp matches. They are strong (subscriber-only posts, 1 to 3 minutes, three different tokens, two of them micro caps) but there is no funding-graph corroboration. **Treat as high confidence, not proven.**
- The old wallet `0x5c54382981bdf5276912a68c1d1a15a5354cc6a0` is still dust: 0 PRM, 0 CEREBRO, 0 INVEST, 6,781,988 MOTH, 0.000097 ETH, nonce 184. The 12 Sep "he has left Robinhood Chain" read was **wrong about the person and right about the wallet**: he left that address, not the chain.
- Two other EOAs matched all three windows and were ruled out as bots: `0xad01c20d5886137e056775af56915de824c8fce5` (nonce 56,878) and `0xcd6b980029e6e6e0733ac8ec3e02be9410d09799` (nonce 84,074), both dust-sized legs across hundreds of tokens. The other 14 intersection hits were the known router set.

### THE BOT FIX (see also [[alert-bot-fleet-9]])
- **Two separate services exist and only one covers Robinhood Chain.** `ghostsol.service` watches the two Solana wallets and is what sent the screenshot. `ghostwatch.service` is the RH watcher, and it was pointed at the drained old wallet, so it could not fire on any of these three calls. **That is the whole reason the alerts went quiet: not a crash, a stale address.**
- ghostwatch was otherwise healthy: active since 15 Sep 01:37 UTC, NRestarts=83 but zero in the last 6 hours, state at the chain tip. The `HTTP Error 429` traceback in its log is the **handled** path (`Rpc.call` already backs off 5 times, the run loop catches and continues), so it is noise, not the fault.
- **Fixed 16 Sep 2026 ~18:53 BKK:** `/opt/ghostwatch/config.json` now watches `0xa2f64ede5fb760498bc500306b3833c479e34211`. Backup at `config.json.bak-20260916-*`. Restarted; verified active, 0 restarts since, 6 seconds behind the tip.
- **BOTH WALLETS ARE ENABLED. I first disabled the old one and Ben overruled me, correctly:** "Leave the old wallet on. Why not? If he uses it again, then we have an alert on it." `tracker.py` batches every configured wallet into the same two `eth_getLogs` calls (`pads = [pad_addr(a) for a in wallets]`), so the old address costs nothing and becomes a free tripwire if he ever refunds it. Relabelled "GHOST RH (old, dormant)". **Standing rule now in [[alert-bot-fleet-9]]: never prune a dormant wallet from a watcher, relabel it and leave it on.**
- **STANDING LESSON FOR THE WHOLE FLEET: a wallet-watcher is not healthy because it is running, it is healthy because the wallet it watches still trades.** Every wallet bot should compare its target's last on-chain activity against a staleness threshold and message once when the target goes quiet for N days, because a drained wallet and a working bot look identical from systemd.