Skip to main content

What to Do If Your Wallet Is Compromised

Immediate steps and recovery options after a wallet hack.

Updated today

Good to know

  • You must be the current owner to transfer your name, and you'll need ETH for gas fees.

  • ENS cannot undo transactions or restore access to hacked wallets.

  • No ENS administrator can change your name's ownership for you.

  • You cannot transfer ownership during the Grace Period.

  • When you re-register after the Grace Period ends, you get a new NFT—the old one is destroyed.


Owner Recovery Basics

To transfer your .eth name (like bob.eth), the current owner must sign an onchain transaction. Your compromised wallet needs ETH to cover gas fees for the transfer.


Immediate Steps

  1. Don't send ETH to the compromised wallet — bots will steal it instantly

  2. Check if you still own the name in the ENS App

  3. Create a new secure wallet


Recovery Options

Method

Risk Level

Details

Wait for bots to stop

High

Sweeper bots sometimes go inactive after weeks

Wait for expiry

High

Let name expire, re-register. Others might get it first.

Flashbots rescue

Advanced

Bundle transactions to outrun bots. Not officially supported.

Common misconceptions

At the time an expired name is then newly registered, the old name is burned. This can alert users who think their wallet is compromised, when in fact the name was unowned. Look at the registration date in the Ownership tab of a name to see if it was newly registered.

Method 1: Wait for the bots to stop

Sweeper bots sometimes stop running after weeks or months, giving you a window to recover your name. However:

  • Sending ETH might wake the bot up, and it could steal your funds before your transfer completes.

  • Warning: Waiting risks losing your name forever.

Method 2 - Waiting for Expiry & Re-Register

Waiting for expiration and re-registering carries these risks:

  • The hacker transfers your name to themselves before it expires.

  • The name's registration is extended — any wallet can do this.

  • Someone else registers your name after it is released.

Method 3: Flashbots Tools (Advanced)

You can recover your name if you're still the registered owner. Advanced users can try these open-source Flashbots tools to rescue assets from compromised wallets:

  • FlashbotsBundlerUI – React app for building Flashbots bundles.

  • flashbots-ens-rescue – tool for ENS recovery.

  • Ambire Wallet have various features around gas usage, which may serve as a recovery option.

⚠ ENS does not support these community-built tools, and they may not be actively maintained.

Method 4: Wallets with Gas Tank features.

Ambire Wallet have various features around gas tanks, which may serve as a recovery option - use leftover tokens across chains the sweeper bot has not touched, to fund a gas tank and then transfer your ENS name.


More on Compromised Wallets

  • Once a wallet’s seed phrase is compromised, there is no way to reverse it - it should be abandoned permanently.

  • Hackers typically drain compromised wallets within minutes.

  • Hackers use sweeper bots that steal any ETH or NFTs you send to the compromised wallet instantly.

  • Your .eth name is an NFT. Whoever controls the wallet holding this NFT controls the name, its records, and settings.

  • You can only transfer ownership while your name is actively registered—not during Grace Period or after release.


Recomendations for future Names

Did this answer your question?