MEVDAO

Recover NFT From a Hacked Wallet: Sweeper Bot Guide

By Merunas Grincalaitis · · 8 min read · 1 view

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: You cannot reverse a blockchain transaction for an NFT that has already left your address, so any website promising stolen NFT recovery after the NFT was transferred is a scam. However, if valuable ERC-721 or ERC-1155 NFTs are still sitting inside your compromised address while an attacker's sweeper bot drains any gas ETH you send in, you can recover an NFT from a hacked wallet by bundling a gas-sponsor transaction and safeTransferFrom inside an atomic Flashbots bundle (eth_sendBundle) or EIP-7702 rescue batch.

Every week I hear from Ethereum collectors who had their ETH and liquid ERC-20 tokens drained by a leaked seed phrase or malware, yet still see their Bored Apes, Pudgy Penguins, ENS domains, Uniswap V3 LP NFTs, or Sablier vesting NFTs sitting inside the hacked wallet. When they send 0.005 ETH to the wallet to transfer those NFTs out via OpenSea or MetaMask, a sweeper bot steals the 0.005 ETH in under two seconds.

Here is the exact technical guide on how to recover an NFT from a hacked wallet before the attacker writes a custom script to take your ERC-721 and ERC-1155 assets, plus what to do if the NFT was already transferred.

Scenario A vs. Scenario B: Can your NFT still be rescued?

Before you do anything else, check your address on Etherscan under the NFT Transfers (ERC-721 / ERC-1155) tab:

Where Is the NFT Right Now? Can You Rescue It Technically? Exact Action Plan
Scenario A: Still in your compromised wallet (sweeper steals gas ETH whenever you try to move it) YES (High success rate) Run an atomic Flashbots bundle ([sponsor_gas, transferFrom]) or EIP-7702 rescue batch so the sweeper never touches the gas ETH.
Scenario B: Staked in an NFT staking contract (owned by your compromised wallet) YES (Requires unstake + transfer bundle) Bundle [sponsor_gas, staking.unstake(tokenId), nft.transferFrom(hacked, safe, tokenId)] in a single block.
Scenario C: Already transferred out to the drainer's address NO on-chain reversal (Beware of stolen nft recovery scammers!) Flag the stolen tokenId on OpenSea/Blur via a police/IC3 report so marketplaces block the thief from selling it.

If you are in Scenario C, read our warning guide on Crypto Recovery Scams: How to Spot Fake "Wallet Recovery" Services so you do not lose money to fake recovery agents on Telegram or X.

Why sweeper bots leave NFTs behind initially (and why you must act fast)

Most automated sweeper bots monitor thousands of leaked private keys simultaneously. Their default loop only watches for native ETH balances (eth_getBalance) and high-liquidity ERC-20 tokens that can be swapped instantly into ETH on Uniswap.

Because NFTs are illiquid, require specific tokenId indexing, or represent complex DeFi positions (like a Uniswap V3 NonfungiblePositionManager NFT (0xC36442b4a4522E871399CD717aBDD847Ab11FE88) or an ENS .eth name wrapper), generic sweepers ignore them on Day 1. However, once a human operator reviews the drainer logs—or sees you repeatedly sending gas ETH to the wallet trying to move an NFT—they will manually sweep or list your NFTs on Blur/OpenSea bids.

How to recover an NFT from a hacked wallet using a Flashbots bundle

To move an ERC-721 or ERC-1155 out of a wallet watched by a sweeper bot nft script, you must submit the gas funding and the NFT transfer together as an atomic bundle (eth_sendBundle) directly to private Ethereum block builders (Flashbots, Titan Builder, Beaverbuild, Rsync):

Tx 1 (Signed by Clean Wallet):       Send exact gas ETH (e.g. 0.0018 ETH) -> Hacked Wallet
Tx 2 (Signed by Hacked Wallet):      nftContract.transferFrom(hackedWallet, safeWallet, tokenId)
Tx 3 (Signed by Hacked Wallet):      nftContract2.safeTransferFrom(hackedWallet, safeWallet, id, amount, "0x")

Crucial technical tips when building an NFT rescue bundle:

  1. Use transferFrom instead of safeTransferFrom for ERC-721 when possible: Standard transferFrom(from, to, tokenId) uses slightly less gas than safeTransferFrom because it skips the onERC721Received callback check on your destination EOA, and avoids unexpected reverts if your safe destination is a multisig without an ERC-721 receiver hook.
  2. Rescue DeFi NFTs first! Many people forget that Uniswap V3 LP positions, Sablier token vesting streams, and fNFT locks are ERC-721 NFTs. Rescuing a Uniswap V3 LP NFT via transferFrom(hacked, safe, tokenId) transfers the entire underlying liquidity pool position to your clean wallet in one move—without even needing to call decreaseLiquidity or collect inside the compromised wallet!
  3. Batch 10+ NFTs in one transaction with EIP-7702: If you have a collection of 15 NFTs stuck in the hacked wallet, signing 15 separate transactions inside a classic Flashbots bundle is clunky and breaks if an attacker installed an EIP-7702 sweeper hook. Instead, use an EIP 7702 Rescue vs Flashbots Bundles transaction where your clean sponsor wallet pays gas directly and sweeps every ERC-721 and ERC-1155 in a single atomic loop.

You can run our open-source Flashbots rescue scripts from the compromised-wallet-sweeper-rescue GitHub repository, follow our code walkthrough in How to Rescue Tokens From a Compromised Wallet With a Sweeper Bot (Flashbots Guide), or use our Sweeper Bot Rescue Service.

Wait: What if the attacker stole my NFT without having my private key? (setApprovalForAll)

Not every NFT theft comes from a leaked seed phrase. If your ETH is still sitting untouched in your wallet, and only a specific NFT collection was drained via a transaction sent by a stranger's address, you signed a malicious setApprovalForAll(operator, true) phishing transaction!

In that case:

  • Your private key is likely not compromised, and no sweeper bot is watching your gas ETH.
  • Immediately open revoke.cash or Etherscan's Token Approval tool and revoke every setApprovalForAll operator on your remaining NFT collections.
  • Read our step-by-step guide on How to Revoke Token Approvals and Permit2 Signatures and move your remaining NFTs to a fresh hardware wallet seed phrase just to be safe.

Frequently asked questions

Can I recover an NFT from a hacked wallet if a sweeper bot steals my ETH?

Yes, as long as the NFT is still held by your compromised wallet address (or staked under that address). Using a Flashbots bundle (eth_sendBundle) or EIP-7702 atomic batch, a clean wallet sponsors the exact gas needed and transfers the ERC-721 or ERC-1155 NFT to your new wallet in the same block, bypassing the sweeper bot completely.

Can I get back a stolen NFT after it was transferred to the hacker's address?

No on-chain tool or service can force an NFT back once it has left your wallet, because Ethereum transactions are irreversible. Anyone messaging you on X, Discord, or Telegram offering "stolen NFT recovery" for an upfront fee is running a recovery scam. What you can do is file a police/IC3 report and submit the transaction hash to OpenSea and Blur support to flag the NFT as stolen so it cannot be traded on major marketplaces.

How do I rescue a Uniswap V3 LP position from a compromised wallet?

Every Uniswap V3 liquidity position is represented by an ERC-721 NFT (NonfungiblePositionManager at 0xC364...FE88). Instead of trying to remove liquidity into the compromised wallet (where a sweeper could steal the tokens), simply rescue the Uniswap V3 NFT tokenId itself to your clean wallet via a Flashbots bundle, then withdraw the liquidity safely from your new wallet.

How do I rescue an ENS .eth domain from a compromised wallet?

An ENS .eth name consists of an ERC-721 token (or an ERC-1155 token if wrapped in the ENS NameWrapper at 0xD4416b13d2b3a9aBae7AcD5D6C2BbDBE25686401) plus its controller/registrant records. You must bundle safeTransferFrom (or setOwner / transferFrom on the BaseRegistrar and Registry) inside a single Flashbots bundle so the attacker cannot hijack the controller partway through.

What if my NFT is staked in a protocol and the wallet is compromised?

Never click "Unstake" in the public mempool, or the NFT will land in your compromised wallet with no gas left to move it. Instead, construct a 3-transaction Flashbots bundle: [Tx1: Sponsor Gas ETH, Tx2: StakingContract.unstake(tokenId), Tx3: NFT.transferFrom(hacked, safe, tokenId)] so the NFT unstakes and leaves the compromised wallet in the exact same block.

Related guides

Have ERC-721 NFTs, Uniswap V3 LP positions, or ENS domains stuck in a compromised Ethereum wallet watched by a sweeper bot? Rescue them now using the MEV DAO Token Rescue Bot with a 3-day free trial at mevdao.org/subscribe, or message me directly on Telegram (@merunas) for immediate help.

← All articles