You still have access to your wallet. The seed phrase works, the app opens, your tokens are displayed. And yet: Every time money arrives, it disappears again after a few seconds.<\/p>\n\n\n\n
Many victims mistake this for a wallet software error or an ongoing network attack. Neither is usually the case. What's happening here is a sweeper bot: an automated script that monitors your address around the clock and immediately forwards every attempt to an address belonging to the attacker.<\/p>\n\n\n\n
The bad news lies in the prerequisite. For a cyberattack sweeper to work at all, the attacker must know your private key or seed phrase. The actual incident, therefore, occurred weeks ago. This article explains the technical details of how this works, how to recognize it, what you should absolutely avoid, and what to make of promises of recovery.<\/p>\n\n\n\n
A sweeper bot is not software installed on your phone or wallet. It runs on a server belonging to the perpetrator. Therefore, there is nothing to delete, uninstall, or clean on your device that would resolve the problem.<\/p>\n\n\n\n
The bot only needs two things: a key to sign on your behalf and a connection to the blockchain. Everything else is automation.<\/p>\n\n\n\n
It's also important to distinguish between different types of attacks: not every loss constitutes a sweeper attack. If you lose individual tokens or NFTs while your Bitcoin or Ethereum remains untouched, the perpetrator likely doesn't have a key, but rather an authorization that you yourself confirmed at some point. Our article on [topic missing in original text] describes in detail how such an attack unfolds, from authorization and disguised signatures to extensive account permissions. Wallet Drainer<\/a>.<\/p>\n\n\n\n The difference is crucial because it determines your options. You can revoke a permission granted. You cannot revoke a compromised key.<\/p>\n\n\n\n Your seed phrase is not a password that can be changed. All the keys for your wallet are permanently calculated from it. Anyone who knows it can restore all associated addresses at any time, regardless of the app used. Reinstalling the app, changing your device password, or switching wallets won't change this.<\/p>\n\n\n\n Incidentally, "sweeping" as a method is not automatically criminal. Exchanges and payment service providers routinely and automatically transfer their deposit addresses to pooled wallets. It only becomes criminal when someone uses your private key.<\/p>\n\n\n\n Before we discuss the bot, this question must be answered, as it determines everything else. Typical ways in which seed phrases or private keys can fall into the wrong hands:<\/p>\n\n\n\n <\/p>\n\n\n\n The answer to this question is not a trivial matter. It determines whether your address can still be saved or must be permanently abandoned.<\/p>\n\n\n\n Blockchains are public. Anyone can monitor any address, and modern interfaces allow this to happen practically in real time. The bot often detects an incoming transaction even before your own wallet app displays the change.<\/p>\n\n\n\n With Bitcoin and similar networks, it doesn't just monitor the one address you know, but all addresses that can be derived from your seed phrase. Therefore, generating a new receiving address in the same wallet won't help.<\/p>\n\n\n\n One point surprises many: The bot doesn't have to strike from the very first cent. Many scripts only react once the amount reaches a point where the transfer is worthwhile after deducting network fees. A compromised wallet can therefore appear perfectly normal for a long time.<\/p>\n\n\n\n The bot has its transaction already prepared and sends it with high priority the moment it is received. In addition, there is a technical factor that is often overlooked in guides: you and the perpetrator are sending from the same address. However, on Ethereum and similar networks, only one transaction per address and meter reading can be recorded on the blockchain.<\/p>\n\n\n\n So, if you deposit ETH to secure your tokens, both transactions will compete for the same slot. The bot automatically adjusts its fee and is ready to go instantly. Once one of the two transactions is confirmed, the other can no longer be executed normally. Manually outbidding via the wallet interface is therefore not a realistic option.<\/p>\n\n\n\n Solana's approach is different. There, a different address can pay the fee than the one from which the funds are withdrawn. In this case, a recovery does not require a deposit to the compromised address.<\/p>\n\n\n\n This mechanism creates a cycle that systematically harms those affected: gas is deposited, gas is withdrawn, gas is deposited again, and there is another loss.<\/p>\n\n\n\n The perpetrator deliberately leaves valuable tokens or NFTs untouched because transferring them incurs fees the wallet doesn't have. They simply wait until you pre-finance these fees. In particularly cynical variations, wallets are intentionally filled with seemingly valuable tokens, and the seed phrase is then deliberately leaked so that strangers pay upfront. The fact that such tokens often have no value at all is part of the scheme.<\/p>\n\n\n\n A single, rapid transfer proves nothing. Only the combination of several characteristics makes the picture clear:<\/p>\n\n\n\n <\/p>\n\n\n\n The opposite is true if your ETH remains untouched and individual tokens or NFTs are missing. In that case, you should check..., why only certain values often disappear with a drainer<\/a>, because in this case your key may not be affected at all.<\/p>\n\n\n\n Sometimes, yes. But only with a single, carefully prepared attempt, never through repeated trials.<\/p>\n\n\n\n On Ethereum and similar networks, the established approach involves combining fee payments and rescue transfers into a single, inseparable package and sending it directly to the block-building entity. The bot doesn't see the gas deposit in advance; both transactions end up in the same block, eliminating any time window. This is technically challenging, not possible on all networks, and not guaranteed.<\/p>\n\n\n\n With Solana, you can move funds out via a separate paying address in a single transaction without having to deposit into the compromised address.<\/p>\n\n\n\n Bitcoin and other UTXO networks don't have this gas problem in the same way; incoming funds can be passed on directly. However, with actively monitored addresses, it remains difficult because both sides are competing for the same amount. You should immediately switch all future payments to a new, unencumbered address.<\/p>\n\n\n\n Assets tied up in staking, liquidity pools, or vesting require individual review. If the payout can be sent directly to a freely chosen address, that's preferable to going through the compromised wallet.<\/p>\n\n\n\n <\/p>\n\n\n\n The last point is the most important. A second wave of fraud regularly follows a cryptocurrency theft. Alleged recovery services, fake government profiles, and manipulated "recovery dashboards" target precisely the situation where you are willing to take another risk.<\/p>\n\n\n\n Remember this: No reputable investigator, support staff, or service provider will ever need your seed phrase or private key. We also never contact victims proactively.<\/p>\n\n\n\n Before you do anything to the device or wallet, make sure you have the following points checked:<\/p>\n\n\n\n <\/p>\n\n\n\n Don't erase the device prematurely. Finding malware can help trace the source of the theft and is important for filing a police report and obtaining insurance. However, this doesn't mean you should continue using it: A potentially compromised device is off-limits for wallets, banking, and email until it has been professionally examined. You can read about the types of evidence that ultimately count at [link to relevant information]. Evidence in cases of crypto fraud<\/a>.<\/p>\n\n\n\n Then file a criminal complaint. We'll show you how to do this below. Report crypto fraud<\/a>.<\/p>\n\n\n\n A piece of information that surprises many: Anyone who forwards payments or makes their account available after the incident could themselves become a target of the authorities. We describe what happens then below. Account blocked due to suspected money laundering<\/a>.<\/p>\n\n\n\n An analysis cannot recover anything, and we want to make that very clear. What it can do is reconstruct the path: from your wallet via the sweeper address to pooled wallets, then via intermediate stations, bridges or mixers, to a payout point.<\/p>\n\n\n\n This is precisely where the real point of intervention lies. If the funds reach a regulated exchange with identity verification, there is a real entity to which authorities can address requests for information and security. In the case of stablecoins, a block by the issuer is also a possibility; see [link\/reference]. Freeze USDT and USDC<\/a>.<\/p>\n\n\n\n Ironically, automation is advantageous from a forensic perspective: it creates regularity, and regularity can be proven. Consistent response times, stable target addresses, balances reduced to zero, and the absence of a daily rhythm create a pattern that can be traced through the public transaction history. We describe what is and isn't possible in more detail below. Recover cryptocurrencies and asset recovery<\/a>.<\/p>\n\n\n\n Whether values are ultimately secured is not decided by us, but by the participating stock exchanges, the authorities, and, if necessary, a court.<\/p>\n\n\n\n <\/p>\n\n\n\n Separating accounts by purpose is the single most effective measure of all: An address that constantly interacts with new applications should never also be your savings account.<\/p>\n\n\n\n A sweeper bot isn't some exotic attack tool, but rather the logical automation of damage that has already occurred. The problem doesn't begin with the script, but with the loss of control over your login credentials. And it doesn't end with the first data breach, because the attacker can maintain control indefinitely.<\/p>\n\n\n\n This results in a clear sequence for you: first clarify what actually happened, then secure evidence, then act. Not the other way around. And the affected address cannot be repaired, but must be abandoned.<\/p>\n\n\n\n If you are unsure how your case should be classified, use our Free initial assessment for crypto fraud<\/a> or Contact us directly<\/a>.<\/p>\n\n\n\n No. There is nothing to remove from your wallet; the script is running on the attacker's device. The cause is not software on your device, but rather knowledge of your key material.<\/p>\n<\/div><\/div>\n\n\n\n No. A new app, a new password, or a different wallet does not change the fact that the same keys can always be derived from a known seed phrase.<\/p>\n<\/div><\/div>\n\n\n\n Because the bot constantly monitors your address and sends a pre-prepared transaction the moment it's received. Trying to counteract this manually is practically impossible.<\/p>\n<\/div><\/div>\n\n\n\n Because transferring tokens incurs fees that the wallet doesn't have. The perpetrator is waiting for you to pre-finance these fees. That's exactly what the gas trap is.<\/p>\n<\/div><\/div>\n\n\n\n Possibly, yes, but only with a one-time, pre-planned transaction and depending on the network. Repeated gas deposits, on the other hand, almost always lead to further losses.<\/p>\n<\/div><\/div>\n\n\n\n No. All addresses in this wallet, including newly generated ones, can be derived from a known seed phrase. You need a completely new wallet with a new seed phrase.<\/p>\n<\/div><\/div>\n\n\n\n Permanently. As long as the key material is known, the bot will respond to every deposit, even months later. The address is a lost cause, not salvageable.<\/p>\n<\/div><\/div>\n\n\n\nHow the seed phrase or private key were even compromised<\/h2>\n\n\n\n
\n
This is how a sweeper bot works technically.<\/h2>\n\n\n\n
Your address is being constantly monitored.<\/h3>\n\n\n\n
Why you practically always lose the race<\/h3>\n\n\n\n
The gas trap: the most expensive pattern for victims<\/h3>\n\n\n\n
How to recognize a Sweeper Bot<\/h2>\n\n\n\n
\n
Saving coins despite a sweeper bot: what else is possible<\/h2>\n\n\n\n
What you should absolutely not do after a Sweeper incident<\/h2>\n\n\n\n
\n
Securing evidence after crypto theft: these are the documents you need<\/h2>\n\n\n\n
\n
What blockchain analysis can and cannot do<\/h2>\n\n\n\n
Here's how to protect yourself in the future<\/h2>\n\n\n\n
\n
Conclusion: The bot is the consequence, not the cause.<\/h2>\n\n\n\n
FAQs about the Sweeper Bot<\/h2>\n\n\n\n
Is it possible to remove a Sweeper Bot?<\/h3>
Is my wallet secure again after a reinstallation?<\/h3>
Why does every deposit disappear immediately?<\/h3>
Why do my tokens remain intact while only ETH disappears?<\/h3>
Can I still save my remaining coins?<\/h3>
Would it help to use a new receiving address in the same wallet?<\/h3>
How long will the address remain at risk?<\/h3>
Is it sufficient to revoke approvals?<\/h3>