Compromised Wallet Checker: Is Your Ethereum Key Leaked?

Q: How do I know if my Ethereum private key is compromised vs. a bad token approval?

Check the From column on Etherscan for the unauthorized transaction. If the transaction that stole your funds was signed directly From: your_wallet_address (especially a native ETH transfer that you didn't approve), your private key or seed phrase is compromised. If the transaction was initiated From: 0xSomeOtherAddress calling transferFrom on a token contract, only a token approval or Permit signature was exploited.

Q: Is there a free compromised wallet checker tool that doesn't require connecting my wallet?

Yes. You only ever need your public wallet address (0x...)—never connect a suspect wallet or type a seed phrase into a "wallet checker" website! You can check Etherscan's Token Approvals tab (etherscan.io/tokenapprovalchecker), inspect the Delegated to EIP-7702 badge on your Etherscan address page, or run our open-source eip-7702-delegation-checker-revoker script.

Q: If one account in my MetaMask or Rabby wallet is compromised, are my other accounts safe?

No! All standard accounts created under the same 12-word or 24-word recovery phrase (Account 1, Account 2, Account 3) share the same master seed (m/44'/60'/0'/0/i). If your seed phrase was stolen, the attacker has the private keys to every single account derived from that phrase across Ethereum, Base, Arbitrum, BSC, and Polygon.

Q: Can I remove a sweeper bot from my compromised wallet so I can keep using the address?

If the sweeper is purely an EIP-7702 delegation and your underlying private key was not leaked, revoking the 0xef0100 delegation to 0x0000000000000000000000000000000000000000 cleans the address. However, if your private key or seed phrase was leaked, no one can delete that key from the attacker's server—you must rescue your remaining assets via Flashbots bundles and permanently retire the address.

Q: How can I rescue tokens that are still inside my compromised wallet?

Use an atomic Flashbots bundle (eth_sendBundle) or EIP-7702 rescue bundle where a clean sponsor wallet funds the exact gas wei and your compromised wallet transfers the tokens out in the exact same block and bundle, leaving zero ETH for the sweeper bot to steal.

By Merunas Grincalaitis (X · GitHub · DEV · Hashnode · Telegram), Founder & Lead MEV Engineer at MEV DAO — Ethereum smart contract, Flashbots & MEV builder since 2017. Last updated: October 2026.

TL;DR: To run a complete compromised wallet checker on any Ethereum address, check three things on Etherscan and Foundry cast: (1) eth_getCode(your_address) — if it starts with 0xef0100, a malicious EIP-7702 sweeper delegation is attached directly to your wallet; (2) Outbound Native ETH Transfers (From: your_address) — if ETH was sent out in 1–2 blocks without your signature, your private key or seed phrase is leaked and watched by an active sweeper bot; (3) ERC-20 Token Txns — if only one or two specific tokens moved via transferFrom while your ETH balance remained untouched, only a token approval / Permit2 signature was exploited and your private key is still safe.

Part of the Compromised Wallet & Sweeper Bot Rescue Topic Cluster: Start with our Pillar Guide, How to Rescue Tokens From a Compromised Wallet With a Sweeper Bot (Flashbots Guide), for the complete architectural blueprint. This guide focuses specifically on compromised wallet checker with production Ethereum mainnet parameters and runnable verification steps.

When funds vanish from MetaMask, Rabby, Trust Wallet, or Ledger, the very first question every victim asks is: "Is my wallet compromised, and how did they drain it?"

Diagnosing the exact type of compromise in the first 5 minutes is critical because picking the wrong fix will lose the rest of your tokens:

If your private key is leaked (sweeper bot), sending 0.005 ETH into the wallet to "revoke approvals" will simply gift that ETH to the hacker's sweeper bot in 2 seconds!
Conversely, if you only signed a malicious ERC-20 approval or Permit2 signature, your private key is not leaked—and revoking that approval immediately stops the attacker from taking the rest of your balance.

Here is the definitive 2026 compromised wallet checker diagnostic table, a 30-second CLI script you can run against any Ethereum address, and the exact recovery playbook for each diagnosis.

Architecture diagram of compromised wallet checker workflow on Ethereum showing Compromised Key, Sponsor + Claim Tx, eth_callBundle Sim, and Flashbots Block Rescue — Figure 1: End-to-end Ethereum execution pipeline for **compromised wallet checker** (Compromised Key → Sponsor + Claim Tx → eth_callBundle Sim → Flashbots Block Rescue).

The 60-Second Ethereum Compromised Wallet Checker Table

Open your wallet address on Etherscan (etherscan.io/address/0x...) and match what you see against these 4 rows:

Diagnostic Signal on Etherscan	What Happened (Root Cause)	Is Your Seed / Private Key Leaked?	Can You Send ETH to the Wallet Safely?	Immediate Action to Take
Badge next to address says `Delegated to 0x...` or `eth_getCode` starts with `0xef0100`	Malicious EIP-7702 Delegation (Pectra smart-account sweeper)	Maybe / Often Yes (either phishing signature or leaked key)	NO! Any ETH sent triggers the delegated contract's `receive()` sweeper hook!	Overwrite delegation (`0xef0100` → `0x000..000`) & rescue tokens atomically via EIP-7702 Rescue Guide.
Native ETH (`Transactions` tab) shows outbound `Transfer` signed `From: your_address` within seconds of deposits	Leaked Private Key / Seed Phrase + Active Sweeper Bot	YES — 100% Leaked	NO! The sweeper bot will steal any ETH deposit within 1–2 blocks.	Abandon the seed phrase; use a Flashbots Sweeper Bot Rescue Bundle to extract remaining tokens/NFTs/stakes.
`Transactions` tab has NO unauthorized tx `From: your_address`, but `Token Transfers (ERC-20)` shows tokens leaving	Malicious ERC-20 `approve()`, `increaseAllowance`, or `Permit2` Signature	NO (Your private key is still safe)	Yes	Revoke the spender allowance immediately using Revoke.cash or our Permit2 Revoke Guide.
All NFTs from one collection left in a single tx called by an external drainer contract	Malicious `setApprovalForAll` or Seaport off-chain order signature	NO (Your private key is still safe)	Yes	Call `setApprovalForAll(operator, false)` on the NFT contract and increment your Seaport counter.

How to run an automated `compromised wallet checker` from your terminal

You don't have to connect your wallet to any third-party website to check if it is compromised. Using Foundry (cast) or curl against any public Ethereum RPC, run these three read-only checks on your public address (0xYourAddress):

# 1. Check for a malicious EIP-7702 delegation attached to your EOA:
cast code 0xYourAddress --rpc-url https://eth.llamarpc.com
# -> If output is "0x", no EIP-7702 code is attached.
# -> If output is "0xef0100<40-hex-chars>", your wallet is delegated to contract 0x<40-hex-chars>!

# 2. Check your current ETH balance (sweeper bots typically leave 0 ETH or < 0.0002 ETH dust):
cast balance 0xYourAddress --ether --rpc-url https://eth.llamarpc.com

# 3. Check if Permit2 (0x000000000022D473030F116dDEE9F6B43aC78BA3) has an active allowance on your USDC/USDT:
cast call 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 \
  "allowance(address,address)(uint256)" \
  0xYourAddress 0x000000000022D473030F116dDEE9F6B43aC78BA3 \
  --rpc-url https://eth.llamarpc.com

We also publish open-source inspection scripts in our eip-7702-delegation-checker-revoker and compromised-wallet-sweeper-rescue GitHub repositories.

How to tell if your wallet has a silent "sleeper" sweeper bot

What if you accidentally pushed a .env file to GitHub or found an info-stealer virus on your PC, is my wallet compromised even if the balance hasn't been drained yet?

Yes—assume any exposed key is permanently compromised. Sophisticated sweeper groups operate two types of bots:

Instant Drain Sweepers: Immediately sweep any ETH balance above 0.0005 ETH.
Threshold "Sleeper" Bots: Watch your leaked address silently without taking your $15 of gas ETH, waiting until you receive a high-value airdrop, unstake 10 ETH from Lido/EigenLayer, or receive a large USDC transfer—and then drain it in the very next block!

If you ever exposed a private key or seed phrase (even for 10 seconds in a public repo or on a machine with malware), never wait to see if a sweeper triggers. Move every transferable asset to a brand-new hardware wallet seed immediately, and use a Flashbots bundle for any locked, vesting, or unstaking positions (see Private Key Leaked on Ethereum? Save What's Left).

What to do next based on your `compromised wallet checker` result

Result A: Only an ERC-20 / NFT Approval or Permit2 Signature was exploited
1. Open How to Revoke Token Approvals and Permit2 Signatures and revoke every unknown spender.
2. Even though your key wasn't leaked, we still recommend migrating your funds to a fresh address so old off-chain Permit/Seaport signatures cannot be replayed later.
Result B: Leaked Private Key (Sweeper Bot) or Malicious EIP-7702 Delegation
1. Stop sending gas ETH to the wallet!
2. Follow our first-hour emergency guide: Wallet Drained? What to Do in the First Hour (Ethereum Checklist).
3. Rescue your remaining ERC-20 tokens, NFTs, airdrops, or staked tokens using an atomic Flashbots + EIP-7702 bundle via our MEV DAO Sweeper Bot Rescue Service (also see How to Claim an Airdrop From a Compromised Wallet and Unstake From a Compromised Wallet: Rescue Locked Tokens).

Frequently asked questions

How do I know if my Ethereum private key is compromised vs. a bad token approval?

Check the From column on Etherscan for the unauthorized transaction. If the transaction that stole your funds was signed directly From: your_wallet_address (especially a native ETH transfer that you didn't approve), your private key or seed phrase is compromised. If the transaction was initiated From: 0xSomeOtherAddress calling transferFrom on a token contract, only a token approval or Permit signature was exploited.

Is there a free compromised wallet checker tool that doesn't require connecting my wallet?

Yes. You only ever need your public wallet address (0x...)—never connect a suspect wallet or type a seed phrase into a "wallet checker" website! You can check Etherscan's Token Approvals tab (etherscan.io/tokenapprovalchecker), inspect the Delegated to EIP-7702 badge on your Etherscan address page, or run our open-source eip-7702-delegation-checker-revoker script.

If one account in my MetaMask or Rabby wallet is compromised, are my other accounts safe?

No! All standard accounts created under the same 12-word or 24-word recovery phrase (Account 1, Account 2, Account 3) share the same master seed (m/44'/60'/0'/0/i). If your seed phrase was stolen, the attacker has the private keys to every single account derived from that phrase across Ethereum, Base, Arbitrum, BSC, and Polygon.

Can I remove a sweeper bot from my compromised wallet so I can keep using the address?

If the sweeper is purely an EIP-7702 delegation and your underlying private key was not leaked, revoking the 0xef0100 delegation to 0x0000000000000000000000000000000000000000 cleans the address. However, if your private key or seed phrase was leaked, no one can delete that key from the attacker's server—you must rescue your remaining assets via Flashbots bundles and permanently retire the address.

How can I rescue tokens that are still inside my compromised wallet?

Use an atomic Flashbots bundle (eth_sendBundle) or EIP-7702 rescue bundle where a clean sponsor wallet funds the exact gas wei and your compromised wallet transfers the tokens out in the exact same block and bundle, leaving zero ETH for the sweeper bot to steal.

Confirmed that your wallet has an active sweeper bot or malicious EIP-7702 delegation? Rescue your remaining ERC-20 tokens, staked ETH, airdrops, and NFTs using the MEV DAO Token Rescue Bot with a 3-day free trial at mevdao.org/subscribe, or message me directly on Telegram (@merunas) for urgent help.

About the Author — Merunas Grincalaitis: Merunas is the Founder and Lead MEV Engineer at MEV DAO, an Ethereum smart contract architect and Flashbots searcher who has built production Solidity contracts, Block-0 sniping engines, and whitehat token rescue bundles since 2017 (author of Mastering Ethereum technical tutorials and open-source MEV frameworks). Verify our open-source benchmarks, Foundry Anvil simulation harnesses, and live bundle tooling on GitHub (@merlox), GitHub Org (@mevdao-org), X (@merunasgrincalaitis), DEV Community, and Hashnode, alongside primary protocol specifications at Flashbots Bundle Docs and EIP-7702 Specification. Need immediate help beating an active sweeper? Contact our 24/7 engineering desk on Telegram (@merunas) or inspect our open-source rescue scripts on GitHub (mevdao-org/eth-sweeper-rescue).