Sweeper bots: why funds vanish the second you refill a compromised wallet

You send a little ETH to your wallet to cover gas, planning to move your tokens somewhere safe. You refresh, and the ETH is already gone. You try again. Same result. That's a sweeper bot: a script that watches a compromised wallet and forwards anything that lands in it to the attacker within seconds. The bot itself isn't the attack — it's proof that someone already has your private key or seed phrase. In 2025 there were at least 158,000 personal wallet compromises. Here's how a sweeper works, why you can't outrun it, and what to do instead.

Last updated: September 2026

What a sweeper bot is, and what it means for your wallet

A sweeper bot is an automated script, loaded with your private key or seed phrase, that monitors your wallet and transfers any incoming funds to an address the attacker controls. Because it holds your key, it can sign transactions exactly as you would, without asking you and without a pop-up.

That's the part to take in first: a sweeper bot doesn't break into a wallet. It moves in after the key has already leaked. Nothing you do inside the wallet app can lock it out, because the attacker isn't using your app at all.

It runs on the attacker's computer, not your phone

A common assumption is that a sweeper is a virus sitting on your device. It isn't. The script runs on infrastructure the attacker controls, connected directly to the blockchain. Changing your app password, reinstalling the wallet, or switching phones won't stop it — the blockchain accepts any transaction signed with the correct key, no matter where it comes from.

Malware on your device may well be how the key leaked, which is why a clean device matters in the recovery steps below. But removing the malware doesn't take the key back.

Sweeper bot or approval drain?

Not every drained wallet has a sweeper on it. Some losses come from a token approval — a permission you granted a malicious contract, which lets it spend one specific token without your key. The fixes are completely different, so it's worth diagnosing before you act.

If gas vanishes on arrival, revoking approvals won't help. The attacker doesn't need permission to spend tokens when they can sign as you. For the difference between the two, see our guide to token approvals.

How the key usually leaks

The attacker needs your seed phrase or private key, and they almost always get it from you rather than from breaking the cryptography. Coin98's hacked-wallet guide lists the common causes: malware on the device, phishing websites, and sharing the seed phrase. The usual delivery methods look like this:

• A "support agent" in a chat or DM asking you to verify your wallet by entering your recovery phrase
• A website that prompts you to "import" or "sync" your wallet
• A compromised or fake browser extension that logs what you type
• An email or message linking to a fake login page

Why the sweeper bot always wins the race

A sweeper bot wins because it reacts to your deposit before the deposit is even confirmed, and it's willing to spend everything you sent to take it. A person watching a block explorer has no chance.

It sees your deposit before it confirms

When you send a transaction, it's broadcast to the network and waits in the mempool — the queue of pending transactions — before a validator includes it in a block. Sweeper bots watch that queue around the clock. The moment a transfer to the compromised address appears, the bot prepares its own transaction to move the funds out, often faster than you could refresh a block explorer.

One detail offers a little reassurance: a sweeper only sees activity you've signed and broadcast. Looking up your address on an explorer or opening the wallet doesn't alert it.

Why paying more gas doesn't help

The natural move is to send gas with a high fee and push your token transfer through first. Against a key compromise, that tends to lose money. Well-built sweepers rank assets by dollar value and will use all the available native coin to take the most valuable thing in the wallet — including the gas you just sent to rescue it.

Some sweepers also map staked tokens to their underlying assets, so they know what those tokens are worth. Tokens that look "left behind" may simply be waiting until they unlock or the bot has gas to move them.

Sweepers now run at industrial scale

Sweeping has become a copy-paste business. Ethereum's Pectra upgrade went live on 7 May 2025 and introduced EIP-7702, which lets a regular wallet point to smart contract code. Within a month, more than 97% of all EIP-7702 delegations were pointing to contracts with identical code, built to automatically drain incoming ETH from compromised addresses. One operation spent roughly 2.88 ETH authorizing about 79,000 addresses, and a single address handled some 52,000 of those authorizations.

The same research found those contracts had received no inbound ETH as of 2 June 2025. The takeaway isn't that EIP-7702 drains wallets — it's that leaked keys get attached to automated sweepers quickly and cheaply, so assume any leaked phrase is being watched.

What to do when a sweeper bot is on your wallet

Stop sending funds to the compromised wallet, create a new wallet with a new seed phrase on a clean device, and treat the old one as permanently lost. A sweeper bot can't be removed, so the goal is to leave, not to fight it.

Stop sending funds to the old wallet

Every coin you send to cover gas becomes the attacker's. Coin98's own guidance is direct: if you suspect a sweeper script is active, don't send additional tokens just to pay gas. That includes exchange withdrawals, payments from friends, and any automated deposits that still point to the old address — update those first.

Start over with a new seed phrase on a clean device

The fix is a completely new seed phrase, not a new account inside the same wallet. Every address derived from a leaked phrase is compromised, including ones you haven't used yet.

1. Check the device. If the leak may have come from your phone or computer, run a malware scan and remove unfamiliar extensions, or use a different device.
2. Create a new wallet. In Coin98 Super Wallet, create a new multichain wallet, which generates a 24-word seed phrase by default.
3. Back up the new phrase offline and never type it into a website, form, or chat.
4. Move anything the bot hasn't taken, only if the old wallet already holds enough gas. Don't top it up.
5. Retire the old wallet completely. Don't reconnect it to dApps, sign with it, or receive into it.

Coin98 Super Wallet is non-custodial, which means Coin98 can't block transactions from a compromised wallet or pull back what's already been taken. Nobody else holds your key, and that's also why nobody else can take it back.

Rescuing stuck tokens is possible, but rarely DIY

If a meaningful amount is still locked in the old wallet, such as staked tokens or an unclaimed airdrop, there are specialist rescue methods on EVM chains. One bundles a gas payment from a separate "sponsor" wallet with the token transfer, so both land in the same block and the sweeper never sees spendable gas. A newer method uses EIP-7702 so the compromised wallet only signs an authorization while a sponsor wallet pays the fees.

Both methods are technical, and they aren't available on every chain — there's no equivalent on Solana, for example. Whitehat rescue teams that run them are selective: one sets a $1,000 recovery minimum and takes 5–10% of what it saves, and one self-service rescue tool charges 20% of recovered tokens. We'd strongly recommend against pasting a private key into any website or downloaded script that promises a rescue.

Watch for recovery scams

A compromised wallet is public on-chain, and scammers watch for victims. Expect messages offering to "remove the sweeper bot" or recover your funds for an upfront fee. A genuine law enforcement complaint center won't ask you to pay to get funds back, or pass you to a company that will. Our overview of social engineering tactics covers the scripts they use, and the immediate action guide explains how to report the theft.

How common wallet compromises are, and how to avoid the next one

Personal wallet compromises are becoming more frequent, even as the average loss shrinks. Attackers are going after more people and taking less from each one, which means ordinary wallets are firmly in scope.

The numbers

In 2025, personal wallet compromises reached at least 158,000 incidents, nearly triple the 54,000 recorded in 2022. The number of unique victims doubled over the same period, from 40,000 to at least 80,000. Yet total losses from these compromises fell from a peak of $1.5 billion in 2024 to $713 million in 2025, dropping from 44% of all crypto stolen to 20%.

Habits that keep a key from leaking

A sweeper bot needs a leaked key, so prevention means protecting the seed phrase and cleaning up what's connected to your wallet.

• Treat any request for your seed phrase as a scam. No legitimate wallet support team, airdrop, or "wallet sync" tool needs it. Our seed phrase guide covers safe storage.
• Keep the phrase off connected devices. No screenshots, notes apps, or cloud documents in plain text.
• Split your activity across wallets. Use a separate wallet for connecting to new dApps, and keep savings in one that rarely signs anything.
• Review the new wallet regularly. Wallet Health in Coin98 Super Wallet scans eight categories, including dApp connections, token approvals, and the backup status of your wallets, and gives you a score from 0 to 100.
• Install wallet software only from official sources, and remove browser extensions you don't recognize.

If your old phrase is gone for good, our guide on what to do after losing or exposing a seed phrase covers the next steps.

Frequently asked questions

Can a sweeper bot be removed from a wallet? No. A sweeper bot runs on the attacker's own systems using your private key or seed phrase, so nothing you change in the wallet app can disconnect it. The only fix is to stop using every address tied to that seed phrase and move to a new wallet with a new phrase.

Is a sweeper bot a virus on my phone? No. The bot runs on the attacker's infrastructure and signs transactions with your stolen key. Malware on your device may be how the key was stolen, so scanning or replacing the device is still worth doing, but cleaning the device won't stop the bot.

Why does the bot take my gas but leave some tokens behind? Sweepers prioritize the most valuable asset they can move, and they need native coins to pay fees. Tokens that seem untouched may be locked, staked, or not yet worth the fee. Sending gas to move them usually gives the bot what it needs to take them first.

Can I create a new account in the same wallet instead? We'd recommend against it. Every account derived from the same seed phrase can be generated by anyone who holds that phrase, including accounts you haven't created yet. A safe fresh start needs a new seed phrase.

Can my wallet provider stop the attacker or reverse the transfers? Not with a non-custodial wallet. Coin98 Super Wallet doesn't hold your keys, so Coin98 can't block transactions from a compromised wallet or reverse confirmed transfers. You can report the attacker's address to exchanges and law enforcement, but confirmed blockchain transactions are final.

Are sweeper bot removal services legitimate? Most unsolicited offers are scams, especially ones that ask for an upfront fee or your private key. Genuine whitehat rescue teams exist for certain EVM chain cases, but they're selective, and they take a share of any funds they manage to save. A genuine law enforcement complaint center won't charge you to recover stolen funds.

Leave the wallet, keep the lesson

A sweeper bot turns a leaked key into a permanent trap: anything that enters the wallet leaves again within seconds. You can't remove it or beat it on gas. What you can do is stop funding it, move to a new seed phrase on a clean device, and ignore anyone selling a rescue. Setting up a new Coin98 Super Wallet and checking it with Wallet Health gives you a clean place to start again.