# Per-bot registry

Verified 2026-08-26. `botctl config <bot>` is always the live answer.

---

## crashbot - `@crash_accum_bot`

`/opt/crash-bot` · `crashbot.service` · poll 12s

Watches nine Solana wallets attributed to Crash (`@CrashiusClay69`) and
alerts on token buys, sells, transfers and SOL funding moves.

| Wallet | Label |
|---|---|
| `ELprCNfd…` | Crash W1 - front-run #2, JOTCHUA −8.6h |
| `5FHsb5Uv…` | Crash W2 - dormant |
| `5kvBH6xs…` | Crash W3 - dormant |
| `FDAutXPS…` | Crash W4 - front-run #1, CUPSEY −33min, JOTCHUA −92h |
| `3fHdjLkZ…` | Crash W5 - CUPSEY whale ~$287k |
| `4NgEJMGC…` | Crash W6 - pump.fun account, ~2,078 SOL |
| `CqWFAqmi…` | Crash W7 - conduit / seller, empty |
| `iGdFcQoy…` | **DISABLED** - exchange hot wallet, not a funder |
| `DZby1cn7…` | FUNDER-2 - closed on-chain; refunding would be a signal |

Thresholds `min_usd 1000`, `min_sol_move 5`. RPC is Helius first with the
public Solana RPC as fallback - the public endpoint alone caused a DNS crash
loop on 2026-08-21.

`iGdFcQoy…` was originally added as a shared funder linking W4 and W5. It
holds ~438,886 SOL and turns over ~425 tx/hour: an exchange hot wallet that
funds thousands of unrelated people. It is **not** evidence of common
ownership, and it was disabled because it would fire ~40 times an hour. The
cluster still stands on the timing evidence, not on the funder.

Takes a baseline snapshot per wallet at startup, so **a newly added wallet
needs a restart**. On start it posts the full wallet list and thresholds to
Telegram - that notice is how a config edit proves itself.

---

## tonalert - `@crashtonbuy_bot`

`/opt/ton-alert` · `tonalert.service` · poll 20s · `min_usd 1000`

Watches one TON wallet, `UQBOHdqPdMVPhx4Lm21Fjn0XTva10qYpNo-GYa-TKdVVfa4K`
= `0:4e1dda8f…`, for jetton buys, sells and LP moves. Its `known_book` maps
four jetton master contracts to names (UTYA, CHERRY, and the UTYA-GRAM and
CHERRY-UTYA LP tokens) - those are **token contracts, not wallets**.

The config carries its own honesty note: attribution to Crash is ~55-65%,
portfolio size matches his stated book but there is no on-chain identity
proof.

**Coverage gap.** The TON cluster found in the wallet hunt is not watched:
`0:ae4ec802` (7,445,009 UTYA ≈ $329,523, active daily) and `0:9631c9fc`
(1,200,000,100 CHERRY ≈ $24,742). `tonwatch.py` takes a single `wallet`
string, so this needs a code change.

---

## gramwatch - `@bk_gramwatch_bot`

`/opt/gramwatch` · `gramwatch.service` · v2

Watches for the Telegram Gram wallet launch on two clocks:

- **channels every 300s** - `durov`, `toncoin`, `ton_blockchain`, `tonstatus`,
  `tgstable`, `tginfo`, scraped from `t.me/s/<channel>`. Free, no quota.
  Durov posting the launch is the CONFIRMED tier and the reason this exists.
- **repos every 1800s** - `FrayxRulez/ton-walletkit-core` and
  `i582/wallet-engine`, the two TON wallet-core ports.

Grades everything CONFIRMED / STRONG / WEAK and states its own weight out of
10. Also posts a health message when sources fail, so silence stays honest.

The split clock is deliberate - see `failure-modes.md`.

---

## xalert - `@xalertben_bot`

`/opt/x-alert` · `xalert.service` · websocket via twitterapi.io

Alerts on posts from `brozinkerbell` and `forginvestments`. Originals,
quotes, replies and retweets are individually toggleable.

Holds a long-lived websocket, so **it writes nothing to its log for hours
when nothing is happening**. Do not read that silence as death. The watchdog
probes it for a live `:443` socket instead. A restart drops the socket and
twitterapi.io holds the slot ~90s, so restarting it "to be safe" costs real
blindness.

---

## rhtracker - `@bk_rhwatch_bot`

`/opt/rh-tracker` · `rhtracker.service` · poll 5s

Watches one Robinhood Chain wallet, `0x688F9499…` (RH Swingtrader 1), for
swaps. Has an allowlist/blocklist and can require a swap event to fire.

---

## ansemtracker - `@bk_ansem_tracker_bot`

`/opt/ansem-tracker` · `ansemtracker.service` · poll 4s, websocket capable

Three Ansem Solana wallets: `GV6UUmNx…` (main), `7oU9nR9V…` (treasury),
`Dt4gYgAU…` (payments, dormant). `min_usd 0` - it reports everything.

---

## basewatch + bwbot - `@bk_basewatch_bot`

`/opt/basewatch` · `basewatch.service`, `bwbot.service`

`basewatch` sweeps eight Solana DEXes every 4 hours for coins between $150k
and $5M cap showing a based, compressed chart after a drawdown. `bwbot` is
the interactive command bot over the same config and the same Telegram bot,
so its replies and the sweep alerts share a thread. `deepdive.py` sits
alongside for on-demand analysis.

---

## kookwatch - own bot

`/opt/kookwatch` · `kookwatch.service`

A Telegram **userbot**: it signs in as Ben's own account, read-only, to watch
kook's paid KookLetter and Trench Warfare groups, because a BotFather bot
cannot read messages in someone else's group. A separate BotFather bot
delivers alerts to his DM. Alerts carry ticker, contract, live MC/liq/5m flow
and a one-tap link to the source message.

Config is `/opt/kookwatch/.env`, not JSON - so it has no `muted` flag and
`botctl mute` refuses it by design.

---

## watchdog - `@crash_accum_bot`

`/opt/watchdog` · **`watchdog-bots.service`** · checks every 300s

See `hosts-and-access.md`. Shares `crashbot`'s token, so its messages appear
under the Crash Accumulation Bot name.