If ETH keeps disappearing as soon as you add it to a wallet, stop topping it up to rescue the tokens still inside.
MetaMask's existing sweeper-bot guidance describes attackers using a compromised private key to sign transfers automatically. Another gas deposit can be taken before you manage to send anything yourself.
Tokens left behind don't establish that the wallet is safe. MetaMask notes that a sweeper may ignore assets below a value threshold. An attacker can also supply their own ETH to extract other assets, so leaving the account without gas doesn't protect those holdings.
If the recovery phrase is compromised, creating another account under that same phrase doesn't give you a safe destination. MetaMask recommends a brand-new recovery phrase and warns against further deposits. Treat the remaining balance as a recovery problem, not a reason to keep feeding the address.
Source: https://support.metamask.io/stay-safe/protect-yourself/fighting-back-against-sweeper-bots/
MetaMask's existing sweeper-bot guidance describes attackers using a compromised private key to sign transfers automatically. Another gas deposit can be taken before you manage to send anything yourself.
Tokens left behind don't establish that the wallet is safe. MetaMask notes that a sweeper may ignore assets below a value threshold. An attacker can also supply their own ETH to extract other assets, so leaving the account without gas doesn't protect those holdings.
If the recovery phrase is compromised, creating another account under that same phrase doesn't give you a safe destination. MetaMask recommends a brand-new recovery phrase and warns against further deposits. Treat the remaining balance as a recovery problem, not a reason to keep feeding the address.
Source: https://support.metamask.io/stay-safe/protect-yourself/fighting-back-against-sweeper-bots/