1

I got phished into sending my Seed Words to a hacker. I already lost some ETH I had there.

I will be getting some tokens on the 29th of May, and I fear the hacker might also steal them. I was thinking that maybe they have some kind of script that will automatically transfer the Tokens to his wallet immediately after they are deposited in my account.

I already tried speaking to the smart contract developer to change the address in the smart contract, but they told me they are unable to change it due to the way the smart contract was designed.

Also I will hire someone on Freelancer to develop the same script for me to withdraw to a safe wallet.

Any other ideas you might have will be really appreciated.

1

I was thinking that maybe they have some kind of script that will automatically transfer the Tokens to his wallet immediately after they are deposited in my account.

It's probably worse than that. If the attacker is sophisticated enough they are probably listening to the transaction pool, so as soon as a transaction is submitted that will deposit tokens to your address, he can construct a transaction to remove them even before the deposit happens.

Further, if they suspect you may attempt a rescue, it's likely they're ready to front-run you by (automatically) incrementally increasing their gas prices.

Whoever you hire to attempt the rescue, be sure that they're up-to-speed on the latest MEV work, and techniques used to beat front-running bots.


Which leads to a couple of other options:

  1. If you are in discussion with the person who will be sending the transaction, don't publish the transaction to the public transaction pool. Instead - if you have pockets deep enough - find a dark pool to privately mine the transaction. (This is a good place to start: https://samczsun.com/escaping-the-dark-forest/)
  2. Second option: contruct a Flashbot bundle, and pay the miner directly. (I think. Someone with more experience of doing this might be better placed to confirm.) See https://flashbots.tools/ - "Rescue your ERC20 from a compromised wallet!"
3
  • Thank you for your answer. Do you think you would be able to help if we get in contact my PM on any chat?
    – Eros
    May 19 at 16:27
  • 1
    Hi again. I don't think I would be the best person to help, given my lack of experience at running defensive actions of this sort. A couple of ideas though: the Flashbots Discord channel -> discord.com/invite/7hvTycdNcK. Or if it's a not-insignificant number of tokens at stake, Georgios Konstantopoulos on Twitter, who I believe is one of the main MEV guys -> twitter.com/gakonst May 19 at 21:14
  • There is a special "whitehat request" chan in discord FB, that would be the ideal place to go ! Nov 17 at 23:58
0

I had the same problem, here is your answer:

I wrote my own script to mimic his and figured out the function triggers when BNB is deposited in an amount>the gas required to move it. So i can send increments of .00005BNB to my wallet and his program wont pick it up... it will take a while but its worth it if you want those tokens back.

0

Hey were you able to find a solution for this? The same thing just happened to me. I have a fairly large amount stuck in a smart contract address that I'm scared to withdraw. I sent a smaller test transaction to the wallet I believed was compromised, and sure enough, the funds were stolen shortly after.

I will checkout the other possible solutions mentioned but am wondering if you had any luck or recommendations. Any guidance or insight would be sincerely appreciated!

New contributor
lawrensp is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.