What to do if you have a sweeper bot on your wallet
Have assets suddenly moved out of your account, without your permission or knowledge? Have you noticed that every time you transfer something into your account, it gets automatically forwarded somewhere else?
If so, you might be dealing with a sweeper bot. This article explains what they are, how they work, and what to do if you have one.
You should immediately stop using accounts associated with your current Secret Recovery Phrase. Any funds deposited may end up being stolen. Continue reading for next steps.
What is a sweeper bot?
Sweeper bots, or "sweepers," are automated scripts that malicious actors deploy to monitor and interact with blockchain transactions. These bots are designed to automatically transfer assets from a compromised account to another address controlled by the attacker. This process, also known as sweeping or scavenging, can happen almost instantly, due to the bot's ability to monitor the mempool or txpool — where pending transactions are stored before being confirmed on the blockchain.
Your wallet can only be affected by a sweeper script if you share your Secret Recovery Phrase with a bad actor.
Sweeper bots are particularly troublesome for two reasons:
- The code can react far quicker than a human ever can. Racing to move your funds through your wallet faster than the script will always result in you coming out second best.
- It is subtle. It is not immediately apparent to the user that they've been hacked, as the script works out of sight. If you perform a significant transaction and you or the recipient do not receive the funds, you may at first assume the transaction is stuck or pending, or that MetaMask has misfunctioned.
How do sweeper bots get installed?
The first and crucial step for a scammer is to obtain your Secret Recovery Phrase. To do so, they may deploy a phishing attack. They may also pose as a friendly helpdesk engineer offering to help you resolve your issue or attempt to disguise themselves as an official MetaMask support account. Another potential avenue is to set up a seemingly trustworthy dapp — or mimic an established one — and require the user to input their private key or Secret Recovery Phrase to use it.
If they are successful, they will be able to access your wallet, obtain your private key, and write it into the sweeper script. Possession of your private key allows the script to sign transactions without your knowledge, giving it total and unrestrained control over wallet activity. The script will then proceed to monitor transactions coming to and from your account and sweep out any tokens you transfer in before you could possibly react.
Your Secret Recovery Phrase allows anyone who has access to it complete and total control over your accounts and funds. Never share your Secret Recovery Phrase with anyone.
On a deeper level
In order to understand how sweepers, and other bots that act on public blockchain networks, operate, a little bit of technical understanding is necessary. A public blockchain network is composed of any number of nodes, each communicating with the rest of the network's nodes and continually maintaining consensus regarding the state of a common ledger.
Users on the network send transactions from their addresses to other addresses. These transactions are broadcast to the closest node(s), which then forward the proposed transaction on to the rest of the network. The user's transaction remains pending for a time, with other recent transactions, in what's known as the transaction pool (txpool) or memory pool (mempool). Meanwhile, the nodes check that the address requesting the transfer has the funds available and reach consensus that the transaction is valid. At that point, a group of validated transactions is grouped together and proposed to the network as a block; when accepted, it is added to the chain.
Sweeper bots scan that pool of transactions for transfers of tokens to the compromised address. As soon as a bot sees an incoming transfer of value, it initiates a second transaction, transferring those assets to a third-party address.
Because this is all automated and actions are taken almost simultaneously with the funds arriving, it might happen faster than the time it takes to refresh a block explorer.
Consider some observed details about sweeper behavior:
- A sweeper might favor the asset that is highest in USD value, even if that means spending more in transaction fees.
- The sweeper may use all available ETH to maximize the value swept out, while also having a high likelihood of "winning" against manual attempts to move funds.
- Even if there is no ETH in the account, an attacker may fund it temporarily in order to cover gas fees to extract other assets (NFTs, Liquidity Pool tokens, etc.).
- If the USD value of assets in the account is below a certain level, the bot may not sweep them out, meaning you may not realize that you have a sweeper on your account.
How can I stay safe?
Keeping your Secret Recovery Phrase secure is the best and most dependable way to avoid falling victim to sweeper scripts. Without it, malicious actors cannot access your private key and sign transactions that steal your funds.
Consider buying a hardware wallet. Popular options include Ledger and Trezor. Hardware wallets are termed "cold" wallets as they store your private keys completely offline, a considerable obstacle to hackers.
As with most things in web3, you should also stay skeptical. Whenever you interact with dapps, do not assume they are reputable and trustworthy. Always do your research and make sure you are comfortable with the risks.
What to do if I have a sweeper bot on my account?
Analyze recently installed applications and browser extensions, especially those from untrusted third parties. Ensure your operating system, security software, web browsers, and other applications are fully updated. Perform a virus/malware scan on any device you have MetaMask installed.
If you have the suspicion that you may have a sweeper bot on your account, there are a couple things you should and should not do.
Do not deposit more funds
Depositing more funds to your account will likely result in losing more funds. When the sweeper bot detects that you've deposited additional funds, it can immediately send these out to another address, resulting in you no longer having access to these funds. These funds are irretrievable, meaning that you will lose them forever.
Report the scam
Report the scam on a blockchain explorer and to your local authorities. Then, report the scam to Chainabuse using the Chainabuse Report Form.
Migrate to a new Secret Recovery Phrase
Do not create additional accounts in your now-compromised Secret Recovery Phrase; any newly-created accounts will also be compromised, and you're likely to lose funds deposited into them.
Instead, generate a brand new Secret Recovery Phrase. Read more about migrating your accounts.
Consider using Flashbots
Any remaining assets in your wallet can potentially be recovered by using Flashbots. You can also open a case with the Flashbots Whitehat team here, if you don't wish to attempt this yourself. Please note that their recovery team requires a $1,000 asset recovery minimum, and they take a 5-10% cut of the recovered assets.
Bringing a bot to a bot fight
In this context—fighting against an automated opponent who takes your ETH from you before you can use it—things can look pretty hopeless. Enter Flashbots, who have developed a project called Flashbots/searcher-sponsored-tx. This allows you, essentially, to pay for the transaction on the compromised address from another account. Or, as they put it: “This is accomplished by submitting a Flashbots transaction bundle, with the first "sponsor" transaction paying the "executor" wallet in ETH, followed by a series of executor transactions that spend this newly received ETH on gas fees.”
This strategy requires two accounts — the compromised account (the executor) and another to pay for the transaction (the sponsor). Success using Flashbots will require significant technical know-how and research. The following instructions are provided as a general guide only.
- Make sure the compromised account has no ETH in it; we highly recommend you use a burner bot first.
- We generally advise running this burner bot on more than one machine, using a different endpoint on each. For example, run a burner locally using Infura, and a burner on a remote server with another provider such as Quiknode. This is so that you have a redundancy plan in case we have high network latency or node issues (rate limits, syncing issues). The code in Flashbots/searcher-sponsored-tx will need to be altered for your specific needs, but the engine is there for you to rescue your tokens from a compromised address. The Flashbots engine is flexible enough to support a single transfer() call, or unstake() and transfer().