If your name is still in the compromised wallet, that wallet can transfer it out. Recovery means changing the Owner role to another wallet you control. ENS cannot forcibly transfer a name.
Good to know
A name in its grace period cannot be transferred. Renew it first, from any wallet, then transfer.
If the wallet is quiet, with no sweeper bot, a standard transfer of the Owner role is the path.
If a sweeper bot is active, there are two routes: Flashbots and smart accounts.
Be wary of anyone offering to recover the name for you. Never share your recovery phrase or private key with anyone.
Do this first
Work out which path you can take.
Stop using the compromised wallet. Sign nothing from it, and send nothing to it until you are ready to move the name.
Check whether you are still the owner. Open the ENS App with no wallet connected, search your name and open the Ownership tab. If Owner is still the compromised wallet, that wallet can still transfer the name out.
Make a fresh wallet with a new recovery phrase, on a different device if you can. This is where the name is going.
Check whether a sweeper bot is on the wallet. A sweeper bot is software the attacker runs that grabs any ETH the moment it arrives. If the wallet still holds ETH, there is likely no bot. If any ETH that reaches the wallet disappears within seconds, a bot is active.
Find your path
Match what you found to a row, then follow that path.
What you found | What it means | Path |
Owner is still the compromised wallet, no sign of a sweeper bot | You could possibly sign the transfer out before a bot is set up | Standard transfer |
Owner is still the compromised wallet, ETH disappears within seconds of arriving | A sweeper bot is active; a standard transfer will not work | If a sweeper bot is active on the wallet |
Owner is still the compromised wallet, name is in grace period (expired, within 90 days) | Transfers are blocked until the name is renewed | Renew it first, then Standard transfer |
Note: a name that looks taken may not have been stolen. If it expired and someone registered it after the 90-day grace period, the old NFT was burned. A fresh one was minted to the new owner. Check the registration date on the Ownership tab: if it is recent, the name was re-registered, not stolen.
Standard transfer
With ETH in the compromised wallet for gas and no bot active, move the Owner role first. Once the Owner is on your new wallet the attacker cannot take the name. That holds even if the Manager and ETH Address still point at the old wallet.
Open the ENS App and connect the compromised wallet. If it holds no ETH for gas, send only what the transfer needs, and only when you are ready to sign straight away.
Search your name, open the Ownership tab and select Edit Roles.
Change Owner to your new wallet's address. Leave Manager and ETH Address as they are. Approve in your wallet.
Wait for the transaction to confirm. The name is safe as soon as it does.
From your new wallet, open Edit Roles again and move the Manager and ETH Address across.
If the ETH vanishes before you can sign step 3, a bot is active: stop and use one of the sweeper-bot paths.
If a sweeper bot is active on the wallet
Use a smart account with a gas tank
A smart account is a smart-contract wallet, and a gas tank lets it pay gas in tokens other than ETH. If the compromised wallet is one of those and still holds tokens the bot has not taken, you may be able to sign the Owner transfer with those tokens. You need to still control its signer. No ETH arrives, so there is nothing for the bot to grab.
Flashbots Rescue (technical)
A Flashbots bundle puts the funding ETH and the transfer into one block, so the bot has no gap to act in. Two community tools do this: FlashbotsBundlerUI (github.com/lcfr-eth/FlashbotsBundlerUI) and flashbots-ens-rescue (github.com/Arachnid/flashbots-ens-rescue).
Important: neither tool is an official ENS product; ENS does not build or maintain them. Use at your own risk.
Wait it out
Bots sometimes go quiet after weeks or months. Watch the wallet. Now and then send a tiny amount of ETH, and move the name the moment it stays. The attacker can move the name meanwhile, and it can expire while you wait.
Let it expire and re-register
The last resort. Stop renewing the name. Anyone can renew a .eth name, the attacker included, so this only works if nobody does. After the 90-day grace period the name enters temporary premium and anyone can register it, so someone else may take it first. See .eth name lifecycle.
Common questions
What if I'm no longer the owner?
If the Owner shown in the ENS App is a wallet that is not yours, the name is already taken. It cannot be forcibly transferred back. Treat the original wallet as fully compromised and revoke any open token approvals: see Revoke token approvals.
Why not use Send to move all three roles at once?
Send moves the Owner last, which gives a bot a window. Moving the Owner on its own first makes the name safe before anything else moves. See Edit the roles on your ENS name.
How do I stop this happening again?
Keep the Owner role on a wallet that never connects to apps, and the Manager and ETH Address on your everyday wallet. A drained everyday wallet then cannot take the name. See How to protect your name with different 'Roles'.