Sweeper Bots: Why Money Disappears the Second You Refill a Compromised Wallet

The wallet is not broken — it is occupied

The mental model most people arrive with is that a hacked wallet is damaged goods: something went wrong inside it, and with the right fix it could be made safe again. That model produces every bad decision that follows. A wallet is not a container. It is a set of addresses derived from a secret, and if that secret leaked, the accurate description is not that your wallet is broken but that somebody else holds a complete, permanent copy of it — and has almost certainly automated what they do with it.

Phantom's support documentation describes the tool they use plainly: a sweeper bot monitors the blockchain for incoming transactions and immediately transfers newly deposited assets to an attacker-controlled address. These bots run continuously and, in Phantom's phrasing, operate far faster than a human can react. They do not sleep, they do not get bored after a week, and they cost the attacker essentially nothing to leave running on thousands of addresses at once. Many people only discover their key is gone because of the symptom rather than the cause — money keeps arriving and then leaving within seconds, over and over, and no explanation fits until this one does.

This is why the instinct to 'secure the wallet' by changing something — a password, a PIN, a device, an app — accomplishes nothing at all. Those protect access to a phrase. They do not change the phrase, and the phrase is what was taken. There is no rotate function, because the words mathematically produce the keys; a new phrase means new keys, which means a different wallet entirely. Phantom's guidance reflects the same reality from the other end: they do not offer fund recovery services, and in most cases, once funds are swept, they cannot be recovered.

So the objective changes. You are not defending this wallet. You are evacuating it once, in the right order, and never touching it again — without handing the attacker a second helping on the way out.

Why the race is unwinnable, and why gas is the trap

The single most common second loss happens like this. Tokens or an NFT are still sitting in the compromised wallet. Moving them costs a network fee, and the wallet has no fee token left because that was the first thing swept. So the owner sends in a small amount of ETH, SOL or whatever the chain requires — and it is gone before they can sign anything. It feels like bad luck or bad timing. It is neither. It is the design working exactly as intended.

The bot is not clicking a button when it notices you. It is watching the pending-transaction pool and submitting its own transaction the moment your deposit is visible, with a fee set high enough to be processed first. You are competing against software that is already awake, already funded, and already authorised by the same key you are using. There is no browser speed, no mobile app, no early morning hour that changes this.

MetaMask's own migration documentation for exactly this situation says so without hedging: if your account has been compromised, adding more of the network's gas token to your account may result in the new gas token balance being swept out before you can take any actions. That is the official guidance from a wallet with every commercial reason to tell you something more hopeful, and it is worth trusting over any forum post promising a trick.

There is one legitimate technical route, and MetaMask names it: transaction bundling, submitted through a service such as Flashbots, where the funding transaction and the rescue transaction are grouped so that they either execute together or not at all — removing the window the bot exploits. Understand what that is before pinning hope on it. It is specialist tooling, it does not work identically on every chain, and a rushed attempt made in a panic can itself cost money. For a modest amount of stranded tokens it is often not worth it. For a high-value NFT or a large token balance, it is the only approach with a real chance, and it is worth reading the documentation slowly before touching anything.

What is never worth it is the third option: anyone who contacts you offering to do the rescue. A drained address is public and its distress visible on-chain, so whoever offers help found you the way the bot did.

Delegated code: the part that survives an empty wallet

Something changed in 2025 that most post-compromise advice has not caught up with. EIP-7702, now final in the Ethereum specification, adds a transaction type that allows ordinary externally owned accounts to set code in their account — in the specification's own words, a delegation indicator is written to the authorizing account's code. Revoke.cash describes the user-facing version: the standard allows normal EOAs to use the same functionality as smart contracts, by setting a delegate smart contract that can act on their behalf.

This is a genuinely useful feature, and it is worth being precise about what is and is not the problem. Revoke.cash is explicit that draining through this route is only possible if your seed phrase is compromised, and in the sweeper scenario this guide is about, that is exactly right — the standard did not create a new way in. What it created is a new way to stay. (A minority are instead signed by the user, key never stolen.) An attacker who already holds your key can point your address at a contract that automatically forwards anything arriving, and the specification is clear about the power that grants: the code specified by an authorization has unrestricted access to the account, and a poorly implemented delegate can allow a malicious actor to take near complete control over a signer's EOA.

This is not theoretical or rare. When Wintermute's research team measured delegations shortly after the upgrade activated, they found that over 97% of all EIP-7702 delegations were authorized to multiple contracts using the exact same code — reused, copy-pasted sweeper contracts they nicknamed CrimeEnjoyors, with a single contract address accounting for more than half of roughly 79,000 authorizations at the time. The economics tell you why: the code is short, simple and free to redeploy, so an attacker points every compromised address they hold at the same bytecode and walks away.

The practical consequence is a step missing from almost every checklist. A delegation persists until it is deliberately changed, so an address can look clean — zero balance, no pending activity — while still having attacker code attached to it. If you are on an EVM chain, check. Revoke.cash lets you inspect all your EIP-7702 delegations in the delegations tab on your account page, and several wallets now surface the same information under smart-account settings. Removing it is a separate matter: most wallets do not allow external dapps to enable or revoke these delegations, so the revocation has to happen inside your wallet application, and support varies. For a wallet you are abandoning anyway this is mostly diagnostic — but it is exactly the check that tells you whether an address you were about to reuse is genuinely yours again.

The evacuation, in the only order that works

If there are assets worth rescuing, sequence matters more than speed, and MetaMask publishes the sequence for precisely this scenario. Before anything else, two preconditions: you are not being physically observed, and the system you are working on is free of malware. That second one is not a formality. If the thing that took your phrase is still running on this machine, every new wallet you create on it is born compromised, and you will repeat this entire exercise in a week.

So start on different hardware if you possibly can — a phone you do not use for the same things, a freshly reinstalled machine, a borrowed device you trust. Create the new wallet there as a genuinely separate instance: a new browser profile or a separate app installation, not a second account inside the same compromised setup. Write the new recovery phrase down on paper, offline, and never let it touch a photo library, a notes app, a password manager's clipboard, or a cloud drive.

Then transfer in MetaMask's recommended order, which is the opposite of what instinct suggests. NFTs go first, because they are likely the most expensive to transfer and you want the fee budget spent on them while it exists. Other tokens go second. Network gas tokens go absolutely last — MetaMask capitalises this point, noting that gas tokens should be the last thing you transfer, because otherwise you will have no way to pay the transfer fees for everything else. Working in that order means each move is funded by what is already there rather than by a fresh deposit the bot is waiting for.

Two things to do after the move, while it is still fresh. First, outstanding token approvals granted to contracts from the old address are a separate exposure that does not travel with your funds — MetaMask's guidance on token approvals covers how to review them, and the habit is worth carrying to the new wallet regardless. Second, write down what happened and when, including transaction hashes, before the details blur; if there is ever a police report or a tax loss to substantiate, that record is the whole case.

Then close the door properly. Remove the old accounts from your wallet interface so you cannot select them by accident, and warn anyone who has your old address saved — an employer, a client, a family member, an exchange withdrawal whitelist. The most avoidable loss after a compromise is a payment someone else sends to the address you forgot to update.

Find the hole, or you will dig it again

Evacuating without identifying the cause is how people end up doing this twice. The phrase did not escape on its own; it left through a specific route, and that route is almost certainly still open.

Work through the realistic list honestly. Was the phrase ever typed into a website, an app, a support chat or a 'wallet validation' page — because nothing legitimate ever asks for it. Does it exist as a photograph, a screenshot, a note, an email draft or a cloud document, where photo-scanning malware and account compromises can reach it. Was the wallet software installed from a search advertisement, a social media link, or a store listing you did not verify. Is there a browser extension with access to everything you do. Was the phrase generated on a device you did not control, or pre-printed on a card that came with it — a sold-as-new hardware wallet arriving with a phrase already filled in is a known scam. And was this address ever restored on a shared or public computer.

The version of this that ends well is unglamorous: a clean device, a fresh phrase generated offline and stored on paper, a hardware wallet if the amount justifies keeping keys off general-purpose computers entirely, and a wallet whose history now starts today.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

• Beware of sweeper bots in your Phantom walletPhantom Help Center
• How to migrate your assets to a new walletMetaMask Help Center
• EIP-7702: Set Code for EOAsEthereum Improvement Proposals
• What Is EIP7702?Revoke.cash
• Post-Pectra, Malicious Ethereum Contracts Are Trying to Drain Wallets, Wintermute SaysCoinDesk
• What are token approvalsMetaMask (Consensys)

FAQ