Rescue USDC or USDT from a wallet with a sweeper bot

Someone has your seed phrase or private key. Every bit of ETH you send to the wallet is gone within seconds, but the USDC or USDT is still there. You can often move it to a safe wallet without ever sending gas into the hacked one.

What a sweeper bot is

After a wallet's key is stolen, the thief often leaves a bot running on it. The bot watches the wallet and forwards any ETH, POL, AVAX or BNB the moment it arrives. Tokens it has not taken stay behind, but you cannot move them: every transfer needs gas, and the gas is gone before you can use it. Sending more gas only feeds the bot.

Why gasrescue can still move the tokens

With gasrescue, no gas is ever sent to your wallet. You sign one message with the hacked wallet, and our relayer submits the transfer and pays the network fee. The amount goes to your new address and our fee to us in one transaction, so there is nothing in between for the bot to catch.

This works for USDC, USDT, USDT0 and USDG on Ethereum, Base, Arbitrum, Polygon, Avalanche, HyperEVM and Robinhood Chain, and for USDC and USDT on Solana, where we pay the fee as well.

Before you start

• Create a new wallet with a new seed phrase. Another account from the same seed phrase is not safe: whoever has the phrase has all of its accounts.
• Use the new wallet's address as the recipient and check it twice. A transfer cannot be undone.
• Act soon. The thief holds the same key and can take the tokens at any time by paying the gas himself.
• Do not send gas to the hacked wallet, and do not swap the stablecoins into ETH there. Any gas that lands in it, the bot takes.

How to move the tokens

1. Enter the hacked address in the wallet check. It shows which stablecoins are still there, on every chain.
2. Import the hacked seed phrase or key into a browser wallet such as MetaMask, Rabby or Phantom, ideally in a separate browser profile, and connect it on gasrescue.
3. Choose the chain and token, press Max and enter your new wallet as the recipient. The quote shows the network fee, our fee and what arrives.
4. Sign once. We simulate the transfer first and only send it if it goes through.
5. Repeat this for every token and chain. Then stop using the old wallet for good.

When it does not work

• The wallet has an EIP-7702 delegation. Many sweepers now attach their own code to the stolen wallet. Block explorers such as Etherscan show it on the address page as a delegation. Signatures from such a wallet are checked by the thief's code, which rejects them. The simulation then fails, we send nothing, and you pay nothing.
• BNB Chain and Tron. On these chains we first put a little BNB or rented energy into the wallet, and the bot could take or use it before your transfer. Do not use gasrescue for a hacked wallet there.
• The thief changed who controls the account. On Tron, thieves often change the account permissions so that only their key can sign. On Solana, they sometimes move a token account to their own address. Then your key no longer controls the tokens, and nobody can move them for you.
• The tokens are frozen by the issuer. Then no transfer works at all. What a freeze means.

Watch out for fake rescuers

People who have just lost a wallet are a favorite target. Nobody needs your seed phrase to help you, and gasrescue never asks for it: you sign in your own browser wallet. Be careful with anyone who contacts you first and offers a rescue for a share of the money.

Common questions