Cookie Settings

We use cookies to improve your experience. Essential and analytics cookies are automatically enabled. View cookie preferences

    Skip to main content
    Practical guide

    Sweeper bot: why your crypto vanishes the moment it arrives

    Published: date not recorded · Reviewed 11 November 2026 · Editorial policy

    You send a little ETH, BNB or SOL to pay the fee for moving your tokens. It lands, and seconds later it leaves for an address you have never seen. You try again. Same result. That is a sweeper bot: a script run by someone who already has your recovery phrase or private key, watching the address and taking every coin that arrives. It does not live on your phone or in your browser. It lives on the attacker's server, and it works from your key. That has one hard consequence. Nobody can "remove" the bot, because the bot is just someone else signing with your key. The wallet stays theirs as long as the key exists. What you can still do is stop feeding it, set up a clean wallet and, in some cases, get specialist help to pull out what is left.

    Check the attacker's address

    Five steps when a sweeper has your wallet

    01

    1. Stop sending gas

    Every top-up is a gift to the attacker. The bot usually reacts faster than a person can sign, often within the same block. Do not split the fee into smaller amounts, raise the gas price or try from another app: it uses the same key and wins the same race.

    02

    2. Confirm the pattern on the explorer

    Open your address on the network's explorer (Etherscan, BscScan, Solscan, Tronscan). Look for incoming native-coin transfers followed almost immediately by outgoing ones you did not sign, usually to the same address. Save these transaction hashes. They are your evidence for an exchange, a wallet provider or the police. On Ethereum and other EVM networks, also check whether the address shows a delegation; see the warnings below.

    03

    3. Create a new wallet on a clean device

    The key leaked somewhere: a fake wallet app, a phishing page that asked for your phrase, malware, a screenshot or a cloud note. Until you know where, assume the device is part of the problem. Create a wallet with a brand-new recovery phrase, on a device you trust or a hardware wallet bought from the manufacturer. A new account inside the old phrase is not a new wallet. Never type the new phrase anywhere except the wallet itself.

    04

    4. Redirect everything that still pays into the old address

    Change your withdrawal address on exchanges, salary or freelance payouts, staking rewards and any service that sends funds to the compromised wallet. Attackers also wait for vesting unlocks and airdrop claims: if a token becomes claimable there, the bot will try to take it first. Revoking approvals on the old wallet helps against approval-based theft, but it does not stop someone who holds the key.

    05

    5. Decide whether a rescue is worth it

    Tokens stuck behind a sweeper can sometimes be pulled out on Ethereum by bundling the gas deposit and the token transfer so they execute together, before the bot can react. This is specialist work. Revoke.cash recommends contacting the Flashbots Whitehat Hotline when more than $1,000 remains in a compromised wallet. Contact it through the Flashbots documentation, not through someone who found you. Below that amount, the honest answer is often to write the balance off and protect the new wallet.

    Got a link or message you are unsure about? Paste it into the free detector

    The traps that follow a sweeper

    • "Bot removal" services: people who reply to your post or DM you offering to delete the bot, unlock the wallet or outrun it with a special tool want an upfront fee, your recovery phrase, or both. The bot is a key in someone else's hands; there is nothing to uninstall. Do not pay.
    • The leaked-phrase bait: a stranger in a chat or comment section "accidentally" shares a recovery phrase and asks for help moving USDT out. The wallet does hold tokens and has no gas. Whoever sends gas to it feeds the sweeper that is already watching. The gentleman who loses his phrase in public is rarely losing anything.
    • EIP-7702 delegations: since Ethereum's Pectra upgrade in May 2025, a normal address can delegate to contract code. With your key, an attacker can delegate your address to a sweeper contract that drains incoming ETH automatically. Wintermute reported in June 2025 that over 97% of the delegations it tracked used identical copy-pasted sweeper code. A delegation can be changed, but whoever holds the key can set it again.
    • Fake police, support and "recovery" agents: no exchange, wallet company or police force asks for your recovery phrase or a fee to release stolen funds. Report the theft with your hashes through official channels.

    Already happened? First steps

    1. Send nothing more and sign nothing new.
    2. Save the transaction hash, the addresses and chat screenshots.
    3. Report it today through official channels; never pay 'recovery' services.
    Where to report crypto theft

    Questions people ask

    Can I remove a sweeper bot from my wallet?

    No. The bot runs on the attacker's machine and signs with your leaked key. There is no software in your wallet to delete. The fix is a new wallet with a new recovery phrase.

    Why did my tokens stay but the gas disappear?

    Many sweepers target the native coin first. Without it, neither you nor anyone else can pay to move the tokens, so the attacker waits for you to send gas and takes it. Some bots also move valuable tokens as soon as gas is available.

    Will revoking approvals stop the sweeper?

    No. Revoking removes spending permissions you granted to contracts. A sweeper with your private key does not need permissions; it signs as you.

    Does this happen on Solana and TRON too?

    Yes. The mechanism depends on the leaked key, not on a particular network. The explorer pattern is the same: incoming coins, then outgoing transfers you did not sign.

    Should I report it?

    Yes, with the transaction hashes and the attacker's address. If stolen funds reach a centralized exchange, a fast report can help it act. Recovery is not guaranteed.

    Keep reading

    Sources

    1. What to do when you get scammed (Revoke.cash)
    2. Whitehat Hotline (Flashbots)
    3. EIP-7702: Set Code for EOAs (Ethereum Improvement Proposals)
    4. Post-Pectra malicious contracts are trying to drain wallets: Wintermute (CoinDesk)

    Got a suspicious message or link? Paste it into the free detector.

    Open detector

    Educational information only — not financial or legal advice.