[Ethereum] Save Tokens from Metamask with Stolen Seed Phrase

metamaskphishingtokens

I got phished into sending my Seed Words to a hacker. I already lost some ETH I had there.

I will be getting some tokens on the 29th of May, and I fear the hacker might also steal them. I was thinking that maybe they have some kind of script that will automatically transfer the Tokens to his wallet immediately after they are deposited in my account.

I already tried speaking to the smart contract developer to change the address in the smart contract, but they told me they are unable to change it due to the way the smart contract was designed.

Also I will hire someone on Freelancer to develop the same script for me to withdraw to a safe wallet.

Any other ideas you might have will be really appreciated.

Best Answer

I was thinking that maybe they have some kind of script that will automatically transfer the Tokens to his wallet immediately after they are deposited in my account.

It's probably worse than that. If the attacker is sophisticated enough they are probably listening to the transaction pool, so as soon as a transaction is submitted that will deposit tokens to your address, he can construct a transaction to remove them even before the deposit happens.

Further, if they suspect you may attempt a rescue, it's likely they're ready to front-run you by (automatically) incrementally increasing their gas prices.

Whoever you hire to attempt the rescue, be sure that they're up-to-speed on the latest MEV work, and techniques used to beat front-running bots.

Which leads to a couple of other options:

  1. If you are in discussion with the person who will be sending the transaction, don't publish the transaction to the public transaction pool. Instead - if you have pockets deep enough - find a dark pool to privately mine the transaction. (This is a good place to start: https://samczsun.com/escaping-the-dark-forest/)
  2. Second option: contruct a Flashbot bundle, and pay the miner directly. (I think. Someone with more experience of doing this might be better placed to confirm.) See https://flashbots.tools/ - "Rescue your ERC20 from a compromised wallet!"
Related Topic