Guide · 2026

How to rescue tokens from a compromised wallet when a sweeper bot is active

If your private key leaked and every gas deposit vanishes instantly, remaining ERC-20 tokens are often still sitting on the address. A normal MetaMask send will fail. This guide covers the EIP-7702 path.

What a sweeper bot does

After phishing or key theft, attackers run automation that watches the compromised EOA. Any native coin (ETH, BNB, MATIC) sent for gas is stolen in the same block or sooner. Tokens and some claimable DeFi positions can remain — but you cannot pay gas from that wallet.

Why Flashbots-style funding often fails now

Classic rescue bundles fund the victim then transfer tokens. Against a fast sweeper, the funding leg is drained. EIP-7702 lets a sponsor pay gas while the compromised account temporarily executes a batch — without leaving spendable gas on the burned address.

Steps

Do not send more ETH to the compromised wallet.
Create a new safe wallet (receive) on a clean device.
Fund a separate sponsor wallet with gas on the target chain (Ethereum, Base, Arbitrum, BSC, Optimism, or Polygon).
Open the Rescue Desk tool, enter the compromised key, sponsor key, receive address, and token contract.
Preview the split, then run rescue. Assets move in one atomic type-4 transaction.

Fee

Rescue Desk charges a 20% success fee on rescued amounts. 80% goes to your receive address. Gas is paid by your sponsor wallet.

Safety

Only use keys for wallets you own. Never paste a seed into random chats. After rescue, abandon the compromised seed forever.

Start rescue