If the compromised wallet still owns your name, you can move the name to a fresh wallet you control, in ENS Explorer. ENS cannot move or freeze a name for you, and will never ask for your recovery phrase or private key. Be wary of anyone who offers to recover it for you.
Do this first
Stop using the compromised wallet. Sign nothing from it, and send nothing to it until you are ready.
Make a fresh wallet with its own recovery phrase, on another device if you can.
Check who owns the name. Open ENS Explorer with no wallet connected, search your name and open the Ownership tab. Then find your row below.
What you found | Path |
The compromised wallet owns the name, and ETH sent to it stays there | Standard transfer |
The compromised wallet owns the name, and ETH sent to it disappears within seconds: a sweeper bot the attacker runs is taking it | If a sweeper bot is active |
The compromised wallet owns the name, and it is in its grace period (expired, but not yet open to others). It cannot be transferred until renewed. | Renew it from any wallet, then Standard transfer |
A wallet that is not yours owns the name | What if another wallet owns the name? |
Standard transfer
Once the transfer confirms, the attacker cannot move the name.
Open ENS Explorer and connect the compromised wallet. If it holds no ETH for network fees (gas), send only what the transfer needs, and only when you are ready to approve the transfer straight away.
Search your name, open the Ownership tab and select Transfer.
In Recipient, enter your fresh wallet's address, and check it.
Choose whether to keep Detach the resolver on. On, the name stops pointing to its records, so you set them again from the fresh wallet. Off keeps them, but the name may still show as the old wallet's primary name.
Select Transfer name, then Start and Open wallet, and approve each transaction. When each is ticked, select Done.
If the ETH vanishes before you can approve the transfer, a bot is active: use a sweeper-bot route.
After the transfer
From your fresh wallet, in ENS Explorer:
Remove the old wallet's roles on the name's Roles tab. You need a wallet that holds Admin.
If the name has a subregistry, make sure your fresh wallet holds the roles you need on it, then revoke every role the old wallet holds on the registry's Roles page.
If Detach the resolver was on, set your ETH address, then your primary name.
If a sweeper bot is active on the wallet
Use a smart-contract wallet with a gas tank
If the compromised wallet is a smart-contract wallet with a gas tank, it can pay gas in tokens other than ETH. If you still control it and the bot has left some tokens, pay the transfer's gas with those. No ETH arrives, so the bot has nothing to take.
Flashbots Rescue (technical, v1 names only)
Only for a name you haven't upgraded to ENSv2; not yet known to work on ENSv2. A Flashbots bundle puts the funding ETH and the transfer in one block, so the bot has no gap to act in. The tools are technical and community-built: ENS does not build or maintain them.
Wait it out
Bots sometimes go quiet after weeks or months. From time to time, send the wallet a tiny amount of ETH, and move the name the moment it stays. Meanwhile the attacker can move the name, and it can expire.
Let it expire and register it again
The last resort: stop renewing. Anyone can renew a .eth name, the attacker included, so this works only if nobody does. After the grace period (28 days on ENSv2, 90 days for a name you haven't upgraded), anyone can register it, with an extra fee at first. See .eth name lifecycle.
Common questions
What if another wallet owns the name?
Then ENS cannot forcibly transfer it back. If it expired and someone registered it after its grace period, nobody took it from your wallet: ENS Explorer shows a recent Registered date. Otherwise, move everything you can out of the old wallet to the fresh one. Revoking approvals helps only if a bad approval was the cause: see Revoke token approvals.
Can ENS support move or freeze my name?
No. ENS support cannot move, freeze or recover a name.
How do I stop this happening again?
Keep the name NFT in a wallet that never connects to apps, and give your everyday wallet only the roles it needs. A drained everyday wallet then cannot take the name. See Grant registry 'roles' to manage your name.