Skip to main content

Recovering a .eth Name from a Compromised Wallet

This article explains some options available if your .eth name is in a compromised wallet.

Updated today

Good to know

  • There are no admin controls to forcibly change the owner of an ENS name. Actions to change owner require onchain transactions signed by the owner address.

  • ENS cannot reverse transactions or recover compromised wallets.

  • Expired names in grace period cannot have their ownership changed.

  • Re-registering a name after expiry and grace period burns the old NFT and mints a new NFT.


How can I recover my .eth name from a compromised wallet?

This article explains some options available if your .eth name is in a compromised wallet.

Ownership Recovery Basics

When dealing with .eth names (e.g., bob.eth), the only way to change ownership is through an onchain transaction signed by the current owner address. This means the compromised wallet must hold enough ETH to pay gas for the transfer.

Understanding Compromised Wallets

  • Once a wallet’s seed phrase is compromised, there is no way to reverse it - it should be abandoned permanently.

  • When a wallet is compromised, funds and NFTs are usually drained quickly.

  • Attackers often deploy sweeper bots that instantly drain any assets sent to the compromised wallet.

  • ENS names are ERC-721 NFTs held in wallets. The wallet with the NFT controls the name ownership, profile records, and Primary Name settings.

  • Ownership transfer is only possible if the name is still in active registration (not in grace period, not released).

Waiting for Sweeper Bots to go Inactive

Sweeper bots may go inactive after weeks or months, creating a potential chance to act. However:

  • Sending ETH may reactivate them, and they can resume before the transfer completes.

  • Waiting is risky: you could lose the ENS name permanently.

Waiting for Expiry & Re-Registration

You could wait for the name to expire and release after grace period, but risks include:

  • The scammer transferring ownership of the name before expiry.

  • Someone else extending the registration (any wallet can do this, not only the owner).

  • Another person registering the name during temporary premium or normal registration.

Using Flashbots to Attempt Recovery

Some open source tools use Flashbots to rescue assets from compromised wallets (advanced users only):

⚠ ENS cannot provide support for these tools. They are open source community builds, and may not be maintained.

Best Practices to Avoid Future Issues

  • Use a hardware wallet for storing and managing ENS names

  • Consider multi-signature wallets for important names.

  • Stay vigilant against phishing attempts; always confirm you are using the official ENS App.

  • Store valuable names in a cold wallet. See Setup your name for Hot, Warm, and Cold Wallets

Did this answer your question?