Scope: suspected sweeper activity
MetaMask describes sweeper bots that monitor a compromised account and rapidly transfer incoming assets elsewhere. An attacker with signing credentials can compete with the account holder, so repeatedly adding gas may simply provide more value for the attacker. Rapid transfers are a reason to investigate, not a complete diagnosis by themselves.
Preserve the sequence
Record the network, affected account, incoming and outgoing transaction identifiers and their times. Stop sending additional deposits while the cause remains unclear. Use a trusted device and the wallet provider's independently verified support route to assess the exposure. Never provide a recovery phrase or private key to someone offering a rescue.
Separate approval problems from key compromise
Removing a token allowance does not remove an attacker's knowledge of a stolen signing key. Conversely, an unwanted token transfer does not automatically prove that every account derived from a backup is compromised. The recovery approach must match the evidence. Avoid experimenting with automated rescue scripts on a valuable account. Wallet Beep does not promise recovery or provide a transaction-racing procedure here; this checklist is intended to prevent repeated deposits and preserve the information needed for an informed response.
Source and review date
MetaMask Help Center — original source. Original publication date not verified in this review. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.