Sweeper Bot

A sweeper bot is automated software that watches an address whose key an attacker already holds and moves anything that arrives out of it, usually within the same block or the next one. It exists because a compromised key is not a one-time theft: once the phrase or key has leaked, the attacker's cost of watching the address indefinitely is nearly zero, so the account is permanently hostile territory rather than temporarily emptied. This is the specific reason the intuitive recovery attempt fails. An owner who finds tokens stranded in a drained wallet often sends gas in order to move them out, and the bot spends that gas first, because it is watching the address and a person is not. Where a token is genuinely worth recovering the only approaches that work submit the funding and the rescue together so the bot cannot be scheduled in between, which is specialist work. The general rule is simpler: a key that has leaked is finished, and the wallet built from it should never be funded again.