How to tell a real sweeper bot rescue from a second scam

if there's a sweeper bot on your wallet you've probably got the DMs already. you posted about it in a discord, or the address popped up on some drain tracker, and now three "recovery experts" want to help you. most of them are a second scam. a couple aren't. this is how we'd sort them out. fair warning, we run one of the paid options ourselves, so take that into account. disclosure's at the bottom.

ok so first, a rescue won't bring back what's already gone. once a transfer confirms it's final, for us and for anyone else. what you can save is the stuff still in there, tokens the attacker didn't bother with, NFTs, staked or vesting positions, an airdrop nobody's claimed. attackers leave more behind than you'd think, because moving some of it costs them gas or needs an extra call.

there's no magic in it. you just stop sending gas on its own. gas and the transfers go in one private bundle, builders put it in a block all at once or drop it, and the bot never gets to see ETH sitting there. oh and run this first:

cast code 0xYourAddress --rpc-url https://ethereum-rpc.publicnode.com

if that prints 0x you're fine. if it starts with 0xef0100 there's an EIP-7702 delegation on the account and clearing it has to go inside that same bundle, otherwise the delegate contract just forwards the gas money out.

so if somebody's promising to get back funds that already left, that's your answer, ignore them. everyone else, ask them a few things.

the big one is the seed phrase. they'll need the old key, the hacked one, because that wallet has to sign the transfers out, there's no way around it. what they should never ask for is the seed of your new wallet. anyone who asks for that one is running the same old play, drain you twice.

then money. "send 0.3 ETH for gas and we'll unlock it" is the oldest advance-fee trick there is. the sponsor wallet does need ETH, but it can be a wallet you made and you fund, you don't hand anyone cash for it.

can they explain the bundle? ask them what goes in it and in what order. when we get asked we just list it: sponsor sends the hacked address exactly enough gas, hacked address sends token A and token B over to your safe wallet, sometimes a tip to the builder last. and we run eth_callBundle on it before anything gets sent. if what you hear back is some fuzzy thing about special software or "tracing the blockchain", i'd walk.

will they show you a simulation? flashbots lets you simulate a signed bundle against the next block, you see the gas and whether anything reverts. a sepolia dry run with throwaway keys is even better. no simulation, no deal.

who messaged who? real people mostly don't cold DM victims. the flashbots whitehat hotline (whitehat.flashbots.net) works the other way around, you open a case with them.

and honestly, you might not need anyone at all. if you're ok running a script, do it yourself. we'd point you at flashbots' searcher-sponsored-tx repo first, it's the usual starting point for ERC-20 and NFT rescues, and there are a couple of newer open-source CLIs now that handle the 7702 part. try it on sepolia with junk keys until it lands, then mainnet. if it's a big amount, call the whitehat hotline before you call us. last we checked their docs want $1,000+ still in the wallet and they keep a percentage.

when is paying someone worth it? mostly when it's messy. like a staked position where you have to unstake, then claim, then transfer, all in one go. or the attacker's awake and fighting you for the same nonce every block. or it's 3am and you'd rather not learn bundle code while your stuff is on fire, which, fair.

so yeah, disclosure. we're MEV DAO and we sell one of these. if you've gone through the checks and want someone to do it for you, the MEV DAO sweeper bot rescue page says how it works and what it costs.

whatever you end up doing, don't send more ETH to the hacked address while you think it over. every top-up goes straight to the bot.