Detecting Sweeper Bots: How to automatically empty compromised wallets

It is one of the most perplexing situations in crypto forensics: The wallet still exists, the Token The funds are still displayed, access via seed phrase or wallet app works, and yet every new deposit disappears within seconds. Those affected often suspect a bug in the wallet software or an ongoing network hack.

In such cases, the actual situation is usually different: an automated script, a Sweeper Bot, The system monitors the affected address and immediately transfers incoming assets to an address controlled by the perpetrator. The actual security incident occurred in the past.

This article provides a technical overview of the phenomenon, distinguishes it from related attack patterns, and describes the traces a sweeper leaves on the blockchain and how these traces can be forensically analyzed. It is aimed at lawyers, companies, and investigators, but is also accessible to those directly affected without a technical background. Those who simply want to know what to do and what not to do now will find the relevant guidance below.

Sweeper Bot, Wallet Drainer and Approval Exploit: The Differentiation

In reporting, the terms are often used synonymously. However, for a reliable investigation, the distinction is crucial because it determines the cause, the recovery options, and whether a wallet can still be used.

How such an attack unfolds in detail, from the release to Permit-Signatures up to delegation-based variants, is discussed in the article on Wallet Drainers Described in detail.

The crucial difference: A permission can be revoked, a compromised seed phrase cannot. It is not a password, but the cryptographic starting material from which all wallet keys are deterministically derived. Anyone who knows it can reconstruct all associated addresses at any time, regardless of the wallet software used. Reinstalling the software, changing the device password, or switching wallets does not change this.

It is not an independent attack pattern, but rather an overarching risk condition. Blind SigningBlind signing is the process of signing transactions or messages whose content and consequences are not fully displayed or explained to the user. It is the very circumstance that enables signature phishing and malicious approvals, and therefore belongs more to the category of prevention than attack typology. Its interaction with simulation evasion is discussed in the section on... Blind signing and simulation bypassing in the Drainer article.

A note on terminology: "Sweeping" is not inherently illegitimate as a method. Exchanges and payment service providers routinely and automatically transfer deposit addresses to pooled wallets. The criminal element only arises from unauthorized access to the key.

Technical Functioning of a Sweeper Bot

Prerequisite: The key has already been used up.

A sweeper is not "installed on the wallet." It runs within the attacker's infrastructure. Essentially, it requires a signable private key and access to the blockchain infrastructure; depending on the level of development, it may also include its own RPC connection., Mempool-Monitoring and automated fee management added.

Therefore, the starting point for root cause analysis is not the bot itself, but rather the question of how and when the access data was compromised. Typical vectors are: PhishingWebsites requesting seed phrases, manipulated wallet apps and browser extensions, info-stealing malware on the end device, unencrypted cloud backups or photos of the seed phrase, fake support, and social engineering via messengers. For the legal classification of assets stolen in this way, see our explanation on... Legal classification of stolen cryptocurrencies in phishing cases.

Real-time address monitoring

Blockchains are public, and modern node interfaces allow for near real-time monitoring:

EVM chains: WebSocket subscriptions (newHeads, newPendingTransactions, Log-Filter) or simply polling the balance every second. The bot can detect a credit balance at the node or mempool level, regardless of when the affected user's wallet interface displays the change.

Solana: `accountSubscribe` and `logsSubscribe` deliver account status changes immediately after confirmation by the leader.

UTXO chains (Bitcoin and similar): Monitoring of incoming UTXOs on all addresses derivable from the seed, not just on the one known address.

Important for the analysis: A sweeper doesn't necessarily activate from the first cent. Many scripts only react once a threshold is reached where the transfer becomes economically viable after deducting network fees. A compromised wallet can therefore remain undetected for an extended period.

Why those affected almost always lose the race for the transaction

The bot has the transaction prepared: correct Nonce, High priority fee, immediate dispatch upon receipt. A crucial point, often omitted in advice texts, is that both the perpetrator and the victim send from the same address. However, on EVM chains, only one transaction per address and nonce can enter the chain.

If the affected party deposits ETH to save their tokens, both transactions compete for the same nonce. In this scenario, the sweeper regularly gains a significant time and fee advantage through automated fee adjustments and immediate delivery. Once one of the competing transactions is confirmed, the other, using the same nonce, can no longer be executed normally.

It should be noted that inclusion in a block is not solely determined by the Priority Fee It depends: Builders take bundles, private order flows, and other economic factors into account. For the affected party, this changes little in practice. Furthermore, replacing an existing item in the mempool typically requires a significant fee increase. Therefore, manually outbidding via the wallet interface is not a realistic solution.

On Solana, the situation is different: there, the fee payer can be a different account than the owner of the assets being transferred. A rescue therefore does not require a SOL deposit to the compromised address; the costs are borne by a separate account within the same atomic transaction.

The gas cycle: the honeypot constellation

This mechanism creates the most expensive pattern for those affected: deposit gas, gas is withdrawn, deposit again, and incur another loss.

The perpetrator leaves the valuables ERC-20-Tokens or NFTs are deliberately held because their transfer costs gas, which the wallet doesn't possess. The perpetrator simply waits for the victim to pre-finance the transaction fees. In particularly cynical variations, wallets are deliberately filled with supposedly valuable tokens, and the seed phrase is then "leaked" to trick third parties into paying gas. We demonstrate that such tokens are often not even genuine below. Fake tokens in blockchain forensics.

Identification patterns: How to recognize an on-chain sweeper bot

A single rapid transfer does not prove automation. The hypothesis only becomes robust through the combination of several indicators:

Latency. The time between inflow and outflow is consistently a few seconds, or one to two blocks. The low variance across many processes is more significant than the absolute value.

Consistency of the target address. All outflows lead to the same address or to a small, stable group of addresses.

Amount heuristic. The transferred amount corresponds exactly to the balance minus the network fee; the address is therefore effectively reset to zero. Manual transfers typically show rounded amounts.

Selectivity. Native coins disappear, while tokens or NFTs remain stable, similar to the gas cycle. Conversely, if tokens and NFTs remain stable while native coins disappear, the other scenario should also be examined. why only certain assets often disappear when a drainer is involved.

Lack of a daily routine. Human behavior follows a circadian pattern. If an address reacts consistently around the clock, even at night and on holidays, this strongly suggests a script.

Fee behavior. Noticeably high or algorithmically adjusted priority fees, sometimes significantly above the network average of the respective block.

Persistence. The address continues to respond unchanged to deposits even weeks or months after the original incident.

Lack of interaction. There are no [things] between the drains. dApp-Interactions, swaps or other typical user actions take place.

A note on attribution discipline: Not every tiny incoming transaction at a targeted address belongs to the attack pattern. Deliberately scattered small amounts can even distort the attribution, as we will discuss below. Dust Attack in Blockchain Forensics represent.

Forensic approach in sweeper cases

Securing evidence first

Before any action on the wallet: export the complete transaction history, back up transaction hashes, block heights, and timestamps uniformly in UTC, take time-referenced screenshots, document the wallet software and version, installed browser extensions, and, if reconstructible, the time and context of the alleged seed disclosure. At the same time, the end device should not be cleaned prematurely: finding an information stealer can close the chain of events and is relevant for legal action and insurance claims. We have discussed what evidence is sufficient for filing a criminal complaint and claiming restitution under [link to relevant section]. Prove crypto fraud compiled.

This explicitly does not mean continuing to use the device. A potentially compromised system should no longer be used for sensitive operations, especially wallet, banking, and email access, and should be professionally forensically secured before any cleanup or reinstallation.

Hypothesis formation instead of conclusion

The starting point is the question of which mechanism is actually at play. Possibilities include: compromised seed phrase, compromised single key, malicious token release, blind signing, wallet drainer, manual transfers by an attacker with device access, compromised endpoint, and, not to be overlooked, actions from the victim's personal network. Each hypothesis is tested against on-chain observable patterns, rather than being derived from the damage description. The methodological foundations and limitations of this approach are described below. Crypto forensics in practice.

Chronology and path reconstruction

The real investigative work doesn't begin with the initial outflow, but with the question of where the funds were subsequently routed. A typical path leads from the victim's wallet via the sweeper address and a collection wallet to intermediate wallets, bridges or mixers, and finally to an off-ramp.

The following information can be analyzed: sender and recipient addresses, transaction hash, amount and token, time and block height, gas parameters, smart contract calls, and the subsequent behavior of the recipient address. Using clustering heuristics—especially common-spend for UTXO chains, and behavioral and timing patterns as well as deposit address mappings for account-based chains—it is often possible to create an address group instead of a single address.

For legal prosecution, the identification of regulated off-ramps is crucial: If funds reach an exchange with KYC requirements, a realistic starting point for information and seizure requests from law enforcement agencies arises. In the case of stablecoins, a block by the issuer is also a possibility; see [reference]. Freeze USDC. When mixing services come into play, the limits of disclosure and legal developments must be assessed separately. Crypto mixers in a compliance and forensics context.

Clear attribution practices are crucial: An address is a technical object. Linking it to a natural person is a separate finding that requires individual justification and must be identified as such in the report. We will demonstrate the possibilities offered by open sources in this regard below. OSINT in fraud cases.

Legal classification as a guide

In Germany, depending on the specific circumstances, the following offenses may be considered: data espionage (§ 202a StGB), computer fraud (§ 263a StGB), fraud (§ 263 StGB), and data manipulation (§ 303a StGB). A criminal complaint should be filed promptly; the Central Cybercrime Contact Points (ZAC) of the State Criminal Police Offices are the appropriate contact point for companies. Civil and tax law issues, such as the consideration of losses, should be handled by a lawyer or tax advisor; for the tax aspects, see our section on... Cryptocurrency losses in cases of fraud and the Federal Fiscal Court's case law. The white paper provides information on the statute of limitations. Deadlines in cases of crypto and investment fraud. This is for guidance only, not legal advice.

Can remaining assets be recovered from a compromised wallet?

Sometimes yes, but only with strategy, never through repeated test deposits.

EVM chains: The established approach involves bundling funding and rescue transfers into a single atomic package, which is then transmitted directly to block builders via a private relay, bypassing the public mempool. This prevents the sweeper from seeing the gas deposit as a pending transaction, and both transactions end up in the same block, eliminating any time window. MyCrypto has documented corresponding rescue scenarios for Ethereum. Limitations: The method is technically demanding, not available on all chains, fails if a builder is not included, and is not guaranteed if the attacker is continuously monitoring the block.

Solana: A separate fee payer allows assets to be moved out in a single transaction without depositing SOL into the compromised address.

UTXO chains: The gas problem does not exist in this form here; incoming UTXOs can be issued immediately. However, recovery attempts are regularly particularly difficult with actively monitored addresses because the perpetrator and the legitimate key holder compete for the issuance of the same UTXO; the chances of success depend on the network, the mempool state, and the transaction structure. In any case, future payments should be immediately redirected to a new, uncompromised address.

Values bound in smart contracts such as Staking-, LP or vesting positions require individual assessment: If a withdrawal to a freely selectable destination address is possible, this is the better option than the detour via the compromised address.

In any case, the following applies: The rescue is a one-time, carefully prepared process, not a trial-and-error procedure. We will consider the implications of promises to subsequently recover assets already lost to be secondary. Recover stolen cryptocurrencies a.

What those affected should avoid after a sweeper incident

• Repeated test or back payments to the affected address
• Continued use of the address as a payment term, even "just briefly"„
• Re-entering the seed phrase on alleged recovery pages
• Installation of unknown "rescue software" or "anti-sweeper tools"„
• Contacting self-proclaimed recovery agents via social media, Telegram, or comment sections

The last point deserves special attention: A second wave of fraud regularly follows a cryptocurrency theft. Alleged recovery services, fake government profiles, and manipulated "recovery dashboards" target precisely the situation in which victims are willing to take further risks. We have investigated the providers and structures behind these scams below. Crypto Fraud Recovery Scam analyzed; a structured initial classification of a specific offer is enabled by our Crypto Recovery Scam Check.

No reputable investigator, support staff, or service provider ever needs a seed phrase or private key. Furthermore, we do not contact victims unsolicited. We document the misuse of our name for such purposes in our [document/report/etc.]. Warning about finanzforensik.com.

One risk is regularly underestimated in this situation: Anyone who forwards payments or provides accounts after the incident can themselves become subject to money laundering proceedings. We describe this scenario below. Fraud victims as unwitting money launderers.

Prevention: How to avoid a key compromise

• Preferably back up the seed phrase exclusively offline; consistently avoid digital copies, especially photos, screenshots, unprotected cloud storage, or plain text notes.
• Hardware wallet for valuable assets; always check signature content on the device display.
• Wallet segmentation: separate addresses for long-term custody and Web3 or DeFi activity.
• Optionally, a BIP-39 passphrase can be used as an additional security measure, with a robust backup concept.
• Approval hygiene: Regularly review and revoke approvals, avoid unlimited allowances.
• Avoid blind signing; consistently verify URLs and extension origins.
• For company assets, multisig or MPC custody with documented four-eyes principle.

Separating wallet purposes is the single most effective organizational measure: An address that regularly interacts with new protocols should never simultaneously be the long-term custodian. We describe how we support companies with prevention, education, and documentation under [link to relevant section]. Financial forensics for companies.

What Sweeper cases mean for law firms, companies and individuals

For lawyers, determining whether key materials have been stolen is crucial to the outcome of a case. It dictates whether the address is to be considered permanently lost, which types of damages are possible, and whether a request for securing the address has any prospect of success. We describe how we support law firms under [link/section name]. Financial Forensics for Lawyers; We provide support for ongoing proceedings under for prosecutors dar.

Private individuals who initially need a preliminary assessment of their case can find information under our brand. Crypto Investigation the right starting point. Our analysis services provide an overview in our Services.

Conclusion: The Sweeper is the consequence, not the cause.

Sweeper bots are not an exotic attack tool, but rather the consistent automation of damage that has already occurred. The problem doesn't begin with the script, but with the loss of control over the cryptographic credentials, and it doesn't end with the first data breach because the perpetrator's control persists.

For those affected, this results in a clear sequence: first clarify the nature of the compromise, then secure evidence, then act, not the other way around.

From a forensic perspective, the initial situation is better than it feels. Automation creates regularity, and regularity is analyzable. Consistent latency, stable destination addresses, balances reduced to zero, and a lack of a daily rhythm form a characteristic profile that can be verified through the publicly available transaction history. This is precisely where the crucial starting points emerge: pooled wallets, intermediaries, and regulated off-ramps. For classifying a specific case Contact us.