Wallet drainers: how crypto wallets get emptied and what to do if yours was

Two ways a wallet gets drained

Someone has the keys. MetaMask describes sweeper bots as automated scripts that watch a wallet and move assets out of it the moment they arrive. They work only because an attacker already holds the recovery phrase: a wallet can be hit by a sweeper script only if that phrase was shared with a bad actor (MetaMask Help Center). The phrase can leak without anyone typing it into a chat — MetaMask also lists malware on a computer where it was stored, phishing sites and fake MetaMask extensions (MetaMask Help Center).

Someone has a permission. The other route needs no key at all: a smart contract given unlimited access to a token can move that token later, even after you have left the site (ethereum.org). How approvals work, and how to revoke them, is in token approvals.

Signs it has happened

MetaMask’s own checklist is two questions: have assets moved out of the account without your permission or knowledge, and does everything you transfer in get forwarded somewhere else straight away (MetaMask Help Center). The second is the signature of a stolen recovery phrase.

What to do

For a compromised wallet, each step below links to the page that describes it:

• Stop sending funds to that wallet. Anything deposited may be swept out as well (MetaMask Help Center, sweeper bots).
• Create a new wallet with a new recovery phrase, on another browser, browser profile or device, and write the phrase down somewhere safe. New accounts inside the compromised phrase are compromised too (MetaMask Help Center, sweeper bots).
• Move whatever is left to the new wallet, and stop using the old one (MetaMask Help Center).
• If the cause was an approval, revoke it, so the contract cannot take what remains (ethereum.org).
• Report the scam on a blockchain explorer and to your local authorities (MetaMask Help Center, sweeper bots).

What cannot be done

MetaMask does not soften this: transactions cannot be reversed, nor missing funds restored, and as a self-custodial wallet it cannot intervene (MetaMask Help Center). That is also the test for any offer of help that arrives afterwards. MetaMask says it will never ask you for your Secret Recovery Phrase, and that anyone claiming to be MetaMask Support who asks for it should be reported. Its general rule is simpler still: whoever asks for your recovery phrase or private keys is trying to steal all of your assets (MetaMask Help Center) — and a promise to reverse transfers promises something the blockchain does not allow.