---
name: uberm-wallets-3
description: Continuation of uberm-wallets-2.md from 19 Sep 2026. The three @0xuberM Solana wallets proven on chain (fomo trading, secret sell wallet, bank), the corrections that settle the PAID hunt, and the ubermsol alert service that now watches them. Read with the two earlier files before any uberM, 0xuberM, NotARandomUser or 0XUBERM ALERT question.
sources: [cowork]
aliases: [0xuberM part 3, uberM wallets 3, uberm-bank-wallet, ubermsol, UBER M SECRET, UBER M BANK]
---
Continues [[uberm-wallets-2]] and [[uberm-wallets]].

## 19 Sep 2026 — the three Solana wallets, all chain-verified
- **UBER M FOMO SOL `2L17Sw85Lh2Ca7ejEzWqyJsZ3yS4DxQhYr52X5H5xRns`**: the on-chain Solana wallet of his NotARandomUser fomo account. Proven by exact amount match to the fomo book (Pigeon 10,273,277.62, Speed 16,642,927.63), re-checked on chain directly. Same account whose Robinhood Chain side is 0xdce001e4ec11ab58650c51ae9658accbe0f49c48.
- **UBER M SECRET `2Rd2Rm17UGzhJXnbEBrHyvhsghyDvuwCpNDioeNQWGGZ`**: the quiet sell wallet. On-chain tx `5rTsb6TLY9p9iEBADk3zt6bdP2D37zvBfW21Db13TSmDsNFZDqkZ5kRGcySHaP4FriA5P8W3UrQdK8RcN9MUsU4L` moves 670,177.69 ANSEM from the fomo wallet to it and it sells one minute later; same pattern for fone, OTC, Qenis, and the 6 Sep STONK mass sell behind his "rugged myself out of stonk" post. Signs its own trades; fees paid by gas relayer `gasTzr94Pmp4Gf8vknQnqxeYxdgwFjbgdJa4msYRpnB`. Empty between trades (0 SOL, dust only on 19 Sep).
- **UBER M BANK `Aw4iFjDqC1Q4V9JDu1BHvYzTR149S6CQiegwjswWaZ6z`**: the cash box, $498,704 USDC on 19 Sep. Flows seen: bank→secret $80k (12 Sep), bank→fomo $30k/$50k/$50k (13, 14, 17 Sep), bank→secret $100k on 18 Sep 22:04 BKK one minute before the PAID blast, secret→bank $98,583 on 19 Sep 05:00 after the dump.
- [stated] Ben's read, which the data supports: he uses the secret wallet to sell things quietly so followers get no notification (ANSEM being the clear case), and the public fomo profile stays clean.
- PAID outcome: bought ~$108k at the top 18 Sep 22:05–22:51 BKK, out by 19 Sep 05:00, about $10k loss. No PAID left in any of the three wallets.

## Corrections to uberm-wallets-2
- **"4Hqk… and CQoz… are fomo routing ids, do not chase" is half wrong.** They ARE fomo-internal labels, but `CQozJjEpLUxoErEpHRrtfwXBSKRabfaR1kV2mx6oTNcS` maps to 2Rd2Rm17 on chain: fomo's recorded $10,000.95 withdrawal at 19 Sep 06:00 BKK is the on-chain 10,001 USDC from 2L17 to 2Rd2 at the same minute. A fomo withdrawal record's `toAddress` is not the on-chain destination; match by time and amount instead.
- Timing between the fomo account and the secret wallet: never in the same minute (0 of 300 secret-wallet trades within 5 min of a fomo swap), but handoffs are one minute apart (fomo Sent → secret sells). One person on two apps.
- His fomo account has traded only Solana since 9 Aug 2026 (950 swaps, 0 on Robinhood Chain), which is why the Robinhood-only ubermwatch bot had nothing from it.

## Methods that worked, keep
- Wallet-hunt from a stream: `yt-dlp --dump-single-json` for the start time, transcript hits for "today", convert to Bangkok, then pull per-candidate `portfolio activity --type buy` in that window; confirm ownership only by a transfer link, never by profit-size coincidence (three coincidental matches were retracted this session).
- fomo user ↔ on-chain wallet: exact token amounts between fomo `hodlers/top` and gmgn `token holders` (39 of 44 public PAID holders matched).
- Where cash goes: derive the wallet's USDC ATA and read its signatures; gmgn's transfer list does not show USDC moves.

## 19 Sep 2026 — UBERMSOL, the Solana leg of 0XUBERM ALERT
- [stated] Ben: "track all three wallets… trades in each wallet, and transfers between wallets. If he moves funds from one wallet to another, let me know. Add that to the current 0xUberm alert… make sure it's real-time."
- **`/opt/ubermsol/ubermsol.py` on the kookwatch droplet, unit `ubermsol.service`, config `/opt/ubermsol/config.json` (mode 600), log `/opt/ubermsol/ubermsol.log`, state `/opt/ubermsol/state.json`.** Cloned from dougsol.py (balance-diff Solana tracker, Helius RPC) plus an inter-wallet layer. Same Telegram bot and chat as ubermwatch, tag 0XUBERM. Poll 3s. Watches the three wallets above with labels UBER M FOMO SOL / UBER M SECRET / UBER M BANK.
- Alerts: coin buys and sells (min $100); MOVE between his wallets, any asset, any size; SOL or stablecoin leaving to an untracked address above $5,000 (how a fourth wallet would surface). Silent: quote-only swaps (USDC↔SOL), transfers in, dust, airdrops. **commands_enabled must stay false**: the bot token is shared with ubermwatch and only one process may poll getUpdates per token.
- Inter-wallet rule: a signature where this wallet moved exactly one asset and another owner moved the mirror amount; counterparty in the watched set → MOVE; fired signatures are skipped by the balance-diff path so nothing is sent twice.
- Harness `/root/test_ubermsol.py` on the droplet replays the six real 18–19 Sep transactions (three USDC moves, ANSEM move, PAID buy, PAID sell); all six correct before go-live. Builder `/root/mk_ubermsol.py`, deployer `/root/deploy_ubermsol.sh`.
- Registered in the watchdog UNITS table and PROGRESS_FILES (state.json, 180s), in /opt/botctl/registry.json and the Mac ~/botctl/registry.json (31 bots). Went live 19 Sep 12:02 Bangkok, first cycles clean.
FINAL WRITE

## 19 Sep 2026, later — the Relay vault, and two ubermsol patches
- [stated] Ben, on the bot's first "sent $10,003 USDC to an address we do not track" card: "Give me an analysis of that new wallet… if it makes sense, we're going to start tracking that also." Verdict: NOT his, not tracked.
- **`7uTT8Xi5RWXzy7h9XL244GRgEycDYDhLjr3ZyNdXi8pZ` is Relay: Depository 2** (Solscan label), the bridge vault fomo uses to move cash between chains: ~1,000 transactions per 6 minutes, thousands of strangers paying in, ~$248k inside. USDC leaving the fomo Solana wallet into it = him bridging Solana → Robinhood Chain. Proof of the loop that day (Bangkok): 16:15 bank→fomo $98,000; 16:16–16:48 eleven $10k clips plus $7.7k into Relay; 16:48 the Robinhood trading wallet 0xdce001e4ec11ab58650c51ae9658accbe0f49c48 buys $9,985 of MOO. Same minute.
- **ubermsol patches, both live:** (1) `known_addresses` in config (Relay vault labelled "Relay bridge (his rail to Robinhood Chain)"); cash into a known address fires `alert_bridge` ("moved $X into Relay bridge, not a new wallet, watch his other chain") instead of the unknown-address card. Add future exchange or bridge vaults there, never as watched wallets. (2) Bridge alerts pass through a 90-second coalescer (`queue_bridge` / `flush_bridges`), so ten $10k clips arrive as one message "in 10 clips". Unit-tested on the droplet. Backups `ubermsol.py.bak-relay`, `.bak-relay2`; patch sources `/root/relay_patch.py`, `/root/relay_patch2.py`.
- Tuning: `recent_sigs` in the inter-wallet scan raised 12 → 50 (a 12-clip burst in 90 seconds would otherwise scroll past), poll 3s → 5s. The fomo wallet carries ~333 token accounts, so its snapshot call trips Helius 429s every few minutes; a 429 only skips that wallet for one cycle and the next cycle diffs against the old snapshot, so nothing is lost. Verified the bot caught all 12 Relay clips and the $98k move on 19 Sep.
FINAL WRITE

## 19 Sep 2026, evening — coins only, and the unpriced-trade gap
- [stated] Ben: "i dont care about moves to a relay bridge etc. no need to notify about that. only if he moves coins, not SOL or stablecoins." ubermsol now skips any inter-wallet or outbound leg whose asset is SOL or a QUOTE_MINTS stablecoin: no MOVE, no bridge card, no sent-out card for cash, ever. Coin transfers between his wallets still alert (the ANSEM-style handoff). `alert_quote_out_min_usd` set to 0; `known_addresses` (Relay) kept but now only informational. Patch source `/root/coins_only.py`.
- [stated] Ben asked why he got no MOO buy alerts. He did: every MOO trade on the trading wallet alerted (18 Sep 22:34 ×2 buys, 19 Sep 05:57 and 08:10 sells, 19 Sep 16:48 buy). The one real miss was a PERKS buy at 15:46 dropped as "skip unpriced token". **ubermwatch `ignore_unpriced_tokens` is now false**: a settlement-contract trade of a coin with no DexScreener price alerts with the token amount instead of a dollar figure, because brand-new coins can be the buys worth seeing. Checked afterwards: PERKS `0xac15f149a78d32133a8a786e26bf13ba435f42a7` is dust (whole coin $4,570, pool $4,555, $1.80 volume a day); he holds 58,521 PERKS ≈ $0.27 in the fomo Robinhood wallet 0xcf6cdf01acb524d8e53d1d13b1a89fcadbd7034c from two clicks (17 Sep, 19 Sep). Not a position. Ben's correction on that episode is in preferences: verdict after the lookup.
- Robinhood Chain RPC (`rpc.mainnet.chain.robinhood.com`) returns 403 to requests without a browser User-Agent and 429s on wide `eth_getLogs`; Blockscout's API is WAF-blocked from the Cowork container. For "what did the trading wallet do today" read `/opt/ubermwatch/ubermwatch.log` on the droplet first; it logs every classified tx.
FINAL WRITE

## 30 Sep 2026 — risk-off day on UBER M TRADING, and a wrong call corrected
- Sold on 30 Sep (Bangkok): SCHIFFY fully (01:54, $24.6k), MOO fully (05:01, $37.8k), AI 811,029 tokens for $146.9k (03:35 to 10:19, 14 tx). Still holds 2,038,287 AI (~$369k at 20:07). No other coin over $1,000 of 355 ever bought; 0 ETH.
- CORRECTION: my first answer said "he did not sell AI", read off balanceOf plus the 19 Sep value. Wrong. A balance cannot show a sell. Fix is `~/bin/flowcheck.py` on the Mac (gmgn activity grouped by tx, 24h/7d/30d sold vs bought, plus live balanceOf), verified against this exact case.
- gmgn `portfolio holdings` for this wallet returned only SPCX/META dust and OMITTED AI entirely; never use it as the holdings answer here, use balanceOf over the tokens from `portfolio activity`.
- gmgn activity shows 0 AI buys in 30d although balance math implies buys since 19 Sep; buys via the app router may be untyped. Unreconciled.