---
name: graildoteth-wallet
description: The 11 Sep 2026 hunt for X caller @graildoteth (Grail.eth, 76.5k followers, Robinhood Chain infra thesis poster). His two linked RH wallets, how every tweet claim was proven from timestamps, and the decoy wallet that was ruled out. Read whenever grail, graildoteth, Grail.eth or his calls (CME, PARE, HOOKR, EARN, DTF, PRM, TWO) come up.
sources: [cowork]
aliases: [grail, graildoteth, Grail.eth, grail-wallet]
---
Related: [[unipcs-wallets]] [[cryptoklotz-wallet]] [[dtf-down-to-finance]] [[twofold-two]] [[pare-stocks]]

# ⚠ RE-CONFIRMED 15 Sep 2026 on a brand-new claim. Wallet A is settled beyond argument.
- [stated] Ben, 15 Sep: "Find his wallet based on his Twitter stream... He's mentioned buying note." He did not know the wallet had already been found on 11 Sep, and that `grailwatch.service` has been watching it since. **Say that first next time before running anything.**
- **THE TEST: he posted his $NOTE thread 15 Sep 06:40 BKK (14 Sep 23:40 UTC), contract `0xc4f730335Fb9e439ca5552f7b52B8E638c4245B0` written into the post itself.** Rebuilt the whole NOTE holder table from 32,247 Transfer legs (809 holders, 2,597 addresses ever touching it).
- **WALLET A `0xdc0aa7c3205fe9c6b077522c5ca1acc4599af0d2` IS THE #1 NOTE HOLDER: 1,197,234 NOTE = 2.00% of supply.** Wallet B holds none.
- **He bought before he posted, in eight clips, and the last one was 29 MINUTES before the thread:** 14 Sep 01:38 (302,421), 02:06 (109,795), 02:14 (108,921), 02:22 (115,843), 03:14 (95,996), then 15 Sep 00:45 (324,761), 05:40 (105,530), **06:11 (83,967)** — all Bangkok time — thread at **06:40**. Then **sold 50,000 at 07:24 BKK, 44 minutes AFTER posting**. Accumulate, publish, trim into the bid.
- Also confirms the staking half: wallet A holds **2,820,476,770 EARN staked in `0xeE7abf316E2824FbFB73aa3EA61217Dd600bD051`**, matching his 13 Sep 02:42 BKK post pointing at `0xa3b6aee90017b72c0812dc1e013de70eb2917ba3` (@EARNONHOOD). The EARN token balance on the wallet itself is zero: it is all in the vault.
- **HIS BOOK HAS ROTATED SINCE 11 Sep. CME `0xe2324FF2a59F8eCBa8c321c6466e59121C00e795` now reads ZERO on both wallets** (was 15M on A and 19M on B), and the DTF Diamond vault `0xe4c9ff4cfd17ae73ecb3825ebdf7db113c146d00` reads zero on both. The 11 Sep positions list above is stale; re-read balances before quoting it.
- The 11 Sep decoy `0xcc708a199b8565c09ba2c0bd5fefa53aaf2036dc` also holds NOTE (374,205, 0.62%, rank 18). It keeps trading around his posts. Not him.

## ⚠ TRAP THAT ALMOST REVERSED THE ANSWER, and it is general
- The first `eth_call` of `balanceOf` for NOTE came back empty and the script rendered it as **`balance 0`**, which read as "grail never touched NOTE" and nearly produced the opposite conclusion. Re-running with the error printed showed `result=0x...fd86328a050b0265fbfc` = 1,197,234.
- **RULE: never render a failed or empty `eth_call` as a zero balance. Print `result` and `error` separately, and treat `None` / `0x` as UNKNOWN, never as nothing held.** On this RPC a transient failure under concurrency is common, so a single zero is not evidence.
- Second half of the same rule, already in [[onchain-forensics]] and proven again here: **a zero wallet balance is not an exit when the token has a staking vault.** A's EARN reads 0 on the token and 2.82B in the vault.

- [stated] Ben asked 11 Sep 2026 to find @graildoteth's exact wallet from his X content (tokens + timestamps), starting from tweets 2096523673251537255 (DTF thread, 6 Sep) and 2098160877585535246 (CME thread, 10 Sep), then to double check everything on both candidate wallets
- RESULT, verified 11 Sep: grail runs TWO linked Robinhood Chain wallets. Wallet A (main) 0xdc0aa7c3205fe9c6b077522c5ca1acc4599af0d2 and wallet B 0xa988002cdde8101d214bd3be92364f07dc11ad8b. They send tokens directly to each other: B to A 297.8M EARN 30 Aug 19:57 and 323.2M EARN 3 Sep 19:57, B to A 120k DTF 4 Sep, B to A 52k ARROW; A to B 572k and 2.385M HOOKR (31 Aug, 4 Sep), A to B 27.9M SCOPL 5 Sep. Together they cover every position claim in his 11 Sep positions post and every earlier "I bought / I sold" tweet
- Wallet A holds (11 Sep): HOOKR 20,000,389 (~$219k, bought 12 to 21 Aug), CME 15,000,000 (~$163k), DTF 15.67M staked in Diamond vault 0xe4c9ff4cfd17ae73ecb3825ebdf7db113c146d00, EARN ~2.2B staked in 0xeE7abf316E2824FbFB73aa3EA61217Dd600bD051. Wallet B holds: PARE 30.4M (~$275k), CME 19.0M (~$195k), PRM 6.95M (~$45k). Combined book ~$900k plus staked DTF and EARN
- Timestamp receipts (all UTC): A sold 4,028,291 NUDES 5 Sep 18:08, staked DTF last at 6 Sep 08:52, tweet 08:59; A BOW out DENAR in 31 Aug 07:00 and 08:09, tweet "moved my BOW into Denar" 09:59; A ARROW out 31 Aug 17:14 DENAR in 17:22, tweet 19:03 "rotated out of ARROW into DENAR"; A sold all DENAR and BOW 10 Sep 20:26 to 21:30 and bought CME, tweet 21:38 "consolidated other positions into this"; B bought 10.9M TWO 29 Aug 05:18 and sold 8.2M same day 15:45, rebought 31 Aug 17:16 to 17:56, tweet 31 Aug 19:03 "sold 80% at 1.5M cap, bought back 40% less", final TWO exit 8 Sep, tweet 11 Sep "cut TWO, lost 25k"; B bought 28.7M PARE 3 Sep 05:26 to 09:11 on launch day, tweet 09:19 "powered into this"; B bought CME from 8 Sep 18:03 (day one) with several in and out rounds, sold 14M 10 Sep 16:09 to 16:33, rebought 11.3M 18:47 to 19:56, matching "700k lowest, 3.8M highest, jumped in and out"; B bought 6.95M PRM 8 Sep 16:42 to 19:15, tweet 11 Sep "50% built"; A CNPY first buy 30 Aug 13:29, tweet 15:40; A MLY 28 Aug, tweet 30 Aug; A SCOPL held 24 Aug to 5 Sep, tweet 28 Aug "took a position"; A ZAPS 21 Aug to 6 Sep, listed 30 Aug
- Only wrinkles: EARN and ARROW were named as positions in the 30 Aug 04:14 thread about 12h before wallet A's first buys (15:46 and 16:35), though wallet B already had 298M EARN from 30 Aug 13:48 that it forwarded to A. DELTA was never a holding claim, only a comparison, and neither wallet ever held either DELTA contract (0xe8ffd7e24187F72afB08d75B1bb13088A989a791 or 0xfa1a5d457a9f9659b1f7bde14576c6be955b6bd5)
- Earlier session claims now corrected: "CME 700k lowest is FALSE" was wrong, it was wallet B's 8 Sep buys; "PARE, PRM, TWO never touched, maybe made up" was wrong, they sit in wallet B
- Decoy ruled out: 0xcc708a199b8565c09ba2c0bd5fefa53aaf2036dc (107-token rotator, funded from Solana DM8HY2X7Fzgb2fzVFUqtV1GtyaFjvQ7jf2zbvvvFTNrs) bought DENAR 8h after the tweet, exited SCOPL before the tweet, never held ARROW or BOW early, sold PARE 2h before the "adding" thread, rebought PRM one minute after the "50% there" tweet. It trades around his posts. Not him
- Not on fomo (handle "grail" is an unrelated 0-trade account). ENS grail.eth = 0x649b0894Ce2BA6199F923F7Db0c45625020C2427 and graildoteth.eth = 0xbdA31758464E3AB676bEa65D9120F5642a8b0a1a, both empty on Robinhood Chain. A was funded via Relay from Solana 4aFQx5NsjazXinJNwyhk4UzyT5wyoUQyrhqPYycphof7, active since Jan 2025 on mainnet, Base, Abstract
- Method that worked: twitterapi.io last_tweets for the timeline, list every token plus minute timestamp, pull DTF Transfer logs into the staking vault (topic2 filter) and NUDES transfers for the 48h window via RH RPC getLogs, intersect stakers with NUDES sellers, verify each tweet against transfer times. The second wallet fell out of the PRM holders x PARE holders intersection: the one big holder that was also a direct counterparty of wallet A. Traps: Dune 402 (credits gone), blockscout and RH RPC rate limit after ~200 calls, a Chrome tab holding big holder maps freezes, the droplet OOM-kills any research script over ~100MB (rhstalk.py sits at 95MB RSS), CME pairCreatedAt 1788830799 is 8 Sep 01:20 UTC not 9 Sep