Rescue Tokens From a Compromised Wallet: Sweeper Bot Rescue Service

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: Yes, you can often rescue tokens from a compromised wallet that a sweeper bot is draining, as long as the tokens are still there. You have three realistic options: do it yourself with open-source Flashbots rescue tools, ask the Flashbots Whitehat Hotline (for remaining assets over $1,000), or use a rescue tool or service, and you must avoid the fake 'recovery services' that target drain victims. Never send more ETH to the wallet; it only feeds the sweeper.

When a wallet is drained by a sweeper bot, the first thing most people search for is a way to get help. That's also the moment they're easiest to scam a second time. I want this article to be the guide I'd give a friend in that position: what a legitimate sweeper bot rescue can and can't do, the realistic options from free DIY to whitehat help, how to tell a real hacked wallet recovery service from a fake one, and the order to do things in.

If you want the technical details of how the bundle itself works, read my step-by-step Flashbots guide to rescuing tokens from a compromised wallet. This article is about deciding what to do and who to trust.

What kind of wallet compromise do you have?

"My wallet got hacked" covers several different problems, and the fix depends on which one you have.

Leaked private key or seed phrase, with a sweeper bot. Any ETH you send disappears within seconds, but your tokens, NFTs or unclaimed airdrops are still there. This is the classic case for a Flashbots rescue.
A malicious EIP-7702 delegation. Since Ethereum's Pectra upgrade, an attacker who has your key can attach code to your address. That code might sweep ETH or block transfers. CoinDesk reported on Wintermute's analysis of a wave of these delegations after the upgrade. Check your address with my guide to finding and removing a malicious EIP-7702 delegation.
A malicious approval or Permit2 signature. In this case your key may be fine. The attacker is spending an allowance you granted. Rescuing tokens won't fix that, but revoking the approval will. See how to revoke token approvals and Permit2 signatures.

Only case 1, and often case 2, needs a rescue in the sense of "beat the bot to the tokens". It also only works for what's still in the wallet. Flashbots' own Whitehat Hotline page is clear: they can only attempt to rescue remaining funds, and they can't get back funds that have already left the address. Anyone who promises otherwise is selling something that doesn't exist.

Why does sending more ETH never work?

MetaMask's support article on fighting back against sweeper bots explains the trap. The attacker's bot watches your address and moves any incoming ETH out immediately, so you can never keep enough gas to move your tokens. Faster top-ups or a higher gas price on your token transfer won't beat an automated script that reacts in the same block.

The fix is to make "fund gas" and "move tokens" a single, indivisible event. That's what a bundle does. A safe wallet's funding transaction and the compromised wallet's transfers go privately to a block builder, which includes them all together in one block or not at all. The sweeper never sees the ETH arrive until it's already been spent. The Flashbots quick start describes how searchers send bundles to builders, and the open-source searcher-sponsored-tx repo from Flashbots is the original reference implementation of this sponsored-rescue pattern.

What are your options for a sweeper bot rescue?

Option 1: Do it yourself with open-source tools

If you're comfortable running a script, you can build the bundle yourself. Projects like searcher-sponsored-tx and eth-rescue show how. You'll need:

The compromised wallet's private key, because only it can sign the token transfers.
A clean funding wallet with ETH for gas and a builder tip.
A brand-new destination wallet created on a device that hasn't been compromised.
An RPC node, and a relay or builder endpoint to submit the bundle to.

Pros: your key stays with you, and you only pay gas and the tip. Cons: a mistake in the bundle (wrong nonce, too little gas, a target block that's already passed) means it silently doesn't land, and you have to work out why. My Flashbots bundles troubleshooting guide covers the usual causes.

Option 2: The Flashbots Whitehat Hotline

Flashbots runs a Whitehat Hotline for compromised wallets. Their page asks you to submit requests only through whitehat.flashbots.net, and to deal only with Discord members who have specific whitehat roles. It also says the team can only help when the remaining assets exceed a minimum rescue amount of $1,000. If you're above that and you don't want to touch code, it's a reasonable place to start. Pay close attention to their instruction to use only that one address, because impersonators exist.

Option 3: A rescue tool or service

There are also paid tools and services that build and submit the bundle for you. They vary a lot, so judge each one on:

Who holds the key. A tool you run yourself, where the key never leaves your machine, is very different from handing your key to an anonymous person in a DM. The key is already compromised, but you still don't want a third party racing you for what's left.
How it's paid. A flat fee, a subscription and a percentage of what's recovered all exist. Know which one it is before you start.
Whether it's honest about limits. A real service tells you it can't recover funds that are already gone, and that some tokens can't be moved (locked, vesting, blacklisted or paused balances).

Here's how the options compare:

Option	What you need	Main limits
Do it yourself (searcher-sponsored-tx, eth-rescue)	The compromised key, a clean funding wallet, a new destination wallet, an RPC and a relay or builder endpoint	A wrong nonce, low gas or a passed target block means the bundle silently doesn't land
Flashbots Whitehat Hotline	A request through whitehat.flashbots.net	Only when remaining assets exceed $1,000; impersonators exist
Rescue tool or service	Depends on the tool; check who holds the key and how it's paid	Can't recover funds already gone or locked, vesting, blacklisted or paused balances
A "recovery service" that DMs you	Nothing	It's a second scam; never pay it

How do you spot a crypto recovery scam?

The FBI has warned repeatedly about this. Its 2023 PSA on companies falsely claiming to recover lost crypto describes "recovery" firms that charge an upfront fee, then disappear or deliver a fake tracing report and ask for more. It notes that private recovery companies cannot issue seizure orders. A 2024 follow-up warns about fake law firms that claim to work with the FBI or other agencies. Red flags:

They contact you first, usually right after you post about the hack on X, Discord or Telegram.
They promise to recover funds that have already been stolen, or to "trace and freeze" them.
They want an upfront fee before doing anything you can verify.
They claim government or law-enforcement ties. The FBI says law enforcement doesn't charge victims to investigate.
They want your seed phrase over chat for a "scan" or "verification".

If funds were stolen, report it at ic3.gov (or to your local police) with the transaction hashes and addresses, as the FBI's guidance for crypto scam victims suggests.

In what order should you do things?

Stop sending ETH to the compromised address.
Secure everything else. Move funds out of any other wallets that share the same seed, using a clean device and a new seed.
Diagnose. Is it a leaked key, a 7702 delegation, or an approval? Check the address on a block explorer.
List what's left. Note token contracts, balances, anything claimable or staked, and its rough value.
Choose a route. DIY bundle, Flashbots Whitehat (if the remaining assets are above their minimum), or a tool you trust.
Test first if you can. Simulate the bundle, or run it against a mainnet fork with Anvil.
Rescue, then abandon the address. The attacker still has the key, so never reuse it.
Revoke approvals on your other wallets and review what led to the compromise.

Frequently asked questions

Can you rescue tokens from a compromised wallet?

Yes, if the tokens are still in the wallet and you still have its private key. A Flashbots bundle funds gas and transfers the tokens atomically in one block, so the sweeper can't take the ETH first.

What is a sweeper bot rescue service?

It's a tool or team that builds and submits that atomic bundle for you. A legitimate one only works on assets that are still in the wallet and is upfront about its fees and about who holds the key.

What is a Flashbots rescue?

It's a rescue done with a Flashbots bundle: the funding transaction and the token transfers are sent privately to builders and executed together in one block. The term also often refers to the Flashbots Whitehat Hotline.

Can a hacked wallet recovery service get back stolen crypto?

Not once it has left your address. Ethereum transactions can't be reversed, and the FBI notes that private companies can't issue seizure orders. Exchanges only freeze funds through their own processes or legal process.

Does the Flashbots Whitehat Hotline charge or have a minimum?

Their page says they can only help when remaining assets exceed a minimum of $1,000, and that requests should only go through whitehat.flashbots.net. Check that page for the current terms.

Can I keep using the wallet after a rescue?

No. Treat the key as permanently burned.

Related guides

MEVDAO's Token Rescue Bot is built for case 1 above: it uses Flashbots bundles through private builders to move tokens out of a wallet that a sweeper bot is draining. It's included in the MEVDAO subscription, and you can start a 3-day free trial. If your case is more unusual, message me on Telegram.