Crypto stolen? Read this first.

My wallet was drained. Can the transactions be reversed?

No. Once a transaction is confirmed, nobody on the network can undo it: not you, not your wallet app, and not anyone who says they can. The exceptions are custodial. An exchange can act on funds that reach an account it controls: in 2020 Coinbase blocked users from sending Bitcoin to the Twitter-hack scam address, and Binance passed my details to a victim so I could return $10,000 of stolen crypto I had intercepted.

What is a sweeper, and why did the ETH I sent for gas disappear?

When a seed phrase or private key is compromised, attackers often leave a sweeper on the address. It is code that watches the chain, including the public txpool, and moves anything that arrives faster than a person can. Sending ETH to pay gas for a rescue usually just feeds it. Some sweepers ignore balances below a set value, so an address can look quiet while it is still being watched. How sweepers work, and how to beat one. Since 2025 the sweeper can also sit on the address itself (see EIP-7702 below).

Can anything still be saved from a compromised wallet?

Sometimes. Tokens that are staked or locked may still be in the wallet because the attacker couldn’t move them yet. Saving them means getting the gas and the unstake-and-transfer transactions mined without showing them in the public txpool, where the sweeper is watching. The sweeper write-up covers ways to do that, and none of them is guaranteed. WHG_1 lists the public cases where I did it, with about $1M returned to users.

How has EIP-7702 changed things when a key is stolen?

EIP-7702 went live with Ethereum’s Pectra upgrade in May 2025. It lets an ordinary address point its code at a smart contract, and that delegation stays until the key signs a new one. Attackers holding a stolen key now use it to put the sweeper on the address itself. At the end of May 2025, Wintermute’s research found that over 97% of all EIP-7702 delegations pointed at contracts with the same copy-pasted code, which they named CrimeEnjoyor. Its only job is to forward any ETH the address receives to the thief. Wintermute track delegations on their EIP-7702 Dune dashboard.

When I did the public rescues on WHG_1 in 2021 and early 2022, the sweeper was a bot running off-chain. It had to see ETH arrive and then send its own transaction, so it was a race. I could win it by keeping the gas and the rescue out of the public txpool, or by using Flashbots so another account paid and the compromised address never held ETH (how that worked). With a CrimeEnjoyor-style delegation, ETH sent to the address is forwarded in the same transaction that delivers it, so there is no gap to race. Replacing or clearing the delegation needs a signature from the key, and the attacker can sign with it too.

If your key is exposed, look the address up on a block explorer before you do anything. An address with a delegation shows code pointing at another contract. Don’t send it ETH for gas. The note Wintermute put in the verified CrimeEnjoyor contract warns not to send ETH or BNB to a delegated address and points owners to the Flashbots whitehat hotline.

How do fake “crypto recovery” accounts find victims?

They watch for people saying they’ve been hacked. In 2021 I ran a bot that posted a bait tweet every hour for 10 days, and 207 accounts replied, most of them set up to look like product support. Replies to tweets containing “hacked” led to accounts advertising account-recovery services, some of them specialising in crypto. Those accounts typically post fake proof, ask for payment upfront, and then disappear. Many other replies led to a branded form asking for a seed phrase or private key (the research). The same pattern runs on Telegram, where imposters copy a group admin’s profile and send a site that asks for your seed phrase.

What should I do first if my seed phrase or private key was exposed?

Create a new seed phrase on wallet software you can verify, move whatever is left to the new address, and remove any app you can’t confirm is genuine. Never type a seed phrase, private key or keystore file into a website, and never hand one to “support”. If you signed a token approval rather than giving away your key, the approved address can keep moving that token up to the approved amount until the approval is reset (how approval scams work).

Can you get my stolen crypto back?

I can’t promise that, and nobody honest can. The rescues on this site worked because the assets were still in the wallet, or because a phishing kit was badly secured, as in this $5,000 interception. If you are dealing with a live incident on an EVM chain, the way to reach me is a message on X at @0x11b6. Never send anyone your seed phrase or an upfront fee.