拿什么拯救你？我被盗的ETH钱包：基于Sweeper机器人和Flashbot的资产拯救策略Rescuing a Compromised ETH Wallet

Introduction

In the world of digital assets, protecting your wallet is absolutely critical. Ideally, your assets would always be safe from any threats -- no one but you could touch your tokens and NFTs. Unfortunately, that's not always the case.

Sometimes your blockchain wallet can get compromised. This usually happens when your private key or seed phrase gets exposed online and someone records it, or when your computer gets infected by malware that leaks the seed phrase stored in your MetaMask wallet.

When this happens, taking emergency measures to try recovering your assets becomes crucial. Typically, when a seed phrase leak occurs (a common sign is assets suddenly being transferred out of your wallet), you should either urgently contact white-hat hackers or quickly move your remaining assets. However, in most cases, hackers will sweep your major holdings at lightning speed. What they often leave behind are staked tokens and some relatively inexpensive NFTs that slip through the cracks.

If you've already found yourself in this unfortunate situation, or if you just want to know what to do if it ever happens, this article will walk you through two tools that can help you salvage a compromised wallet: Flashbot and Sweeper bot.

You don't need a ton of coding knowledge, but I'd recommend being careful with every step. If you have zero experience with blockchain network code, I suggest following my instructions step by step -- there's a very good chance you'll successfully rescue your stolen assets.

To be clear: I'm talking about NFTs or staked tokens that the hacker hasn't gotten around to transferring yet. Assets that have already been moved will never be recoverable!

What Are Sweeper Bots and Flashbot?

"Sweeper bots" are automated programs on blockchain networks that monitor address balances and automatically transfer assets to another wallet when exploitable conditions arise. They're constantly looking for opportunities -- scripts written by scammers scan the latest block heights at blazing speed, and the moment they detect ETH deposited into a compromised wallet, they immediately swoop in to transfer it out. This usually makes recovering assets from the wallet extremely difficult, if not impossible.

However, with Flashbot and some essential skills, you might still have a shot at reclaiming your assets. The process takes some expertise and effort, but if it works, the payoff is absolutely worth it. In the following sections, I'll walk you through how both tools work and the best strategies for attempting to recover your wallet.

What Is Flashbot?

Flashbot is a cutting-edge tool designed to optimize transactions. It allows users to interact directly with miners on the Ethereum network to include their transactions in upcoming blocks. By using Flashbot, users can bid for their transaction's position within a specific block, optimizing both speed and cost.

In plain English: your transactions sent to the blockchain can execute multiple operations within the same block, and they won't be placed in the public mempool -- which prevents the Sweeper bots mentioned earlier from front-running your transactions.

But with the method I'm sharing here, you don't need to understand complex technical details. The approach I'm providing is all simple GUI-based operations -- just follow the steps one by one!

More specifically, Flashbot has these key advantages:

• Configurability: Users can freely choose transaction targets and their own MEV-Share settings.
• Front-running protection: Your transactions won't be visible to asset-stealing bots in the public mempool.
• MEV (Maximal Extractable Value) rebates: If your transaction creates MEV, you can get back up to 90% of the MEV through MEV-Share.
• No failed transactions: Your transaction will only be included if it contains no reverts, so you never pay for failed transactions.

Flashbot RPC is a specially configured RPC that optimizes transaction speed and inclusion.

Flashbot RPC has these key features:

• Fast mode: Users can accelerate their transaction inclusion by using Flashbot RPC's fast mode. When configuring Protect RPC, click "fast", or manually set the RPC to rpc.flashbots.net/fast.
• Broad sharing: By default, Protect transactions are only shared with Flashbots Builder, which only builds a subset of all Ethereum blocks. In fast mode, transactions are shared with all registered builders, increasing the number of blocks your transaction can be included in.

There are three ways to use Flashbot Protect:

• Add the Flashbots Protect RPC to your wallet -- most users go with this option.
• Send transactions to the RPC URL using eth_sendRawTransaction.
• Send transactions to Flashbots using eth_sendPrivateTransaction.

Which method you choose depends on your preference. The simplest way to use Flashbots Protect is to add the Flashbots Protect RPC to your wallet.

Step 1: Deploy Your Sweeper Bot or BurnGas Bot

1.1 Set Up Your Dev Environment

Before you begin, make sure you have the right development environment installed and configured. You'll need Node.js, npm, and a text editor that supports JavaScript or TypeScript.

You'll also need some testnet gas so you can run transactions and pay gas fees. You can grab testnet tokens from various testnet faucets depending on your needs.

1.2 Write the Sweeper Bot Code

Next, you need to write the bot's code. Your code should include functionality for reading information from the blockchain, understanding potential transactions, and executing them.

The core function of a Sweeper bot is to detect compromised assets and transfer them out as quickly as possible.

A BurnGas bot, on the other hand, works by executing favorable transactions and consuming as much gas as possible, making it harder for the scammer's other transactions to go through. For the BurnGas bot, you can refer to https://twitter.com/smpalladino/status/1373049027365904389（在新标签页中打开） (opens in a new tab) for deployment instructions!

I'm using a Sweeper bot I wrote myself. Its features include:

• Multi-chain front-running support for Arbitrum, Optimism, BSC, Ethereum, and Polygon
• Supports repeated execution; simple and effective deployment with virtually no bugs
• Known limitation: You'll need to provide your own faster RPC node, or you can try using public nodes (but this will likely fail)

My Sweeper bot code requires the following:

Before running, install the necessary environment and I recommend testing on a testnet first:

1. Copy the first code block and save it as package.json
2. Copy the second code block and save it as bot.js
3. Run npm install in the command line to install dependencies
4. Run node bot.js in the command line
5. The code should start running automatically

First code block -- package.json

{
  "name": "your-packet-name",
  "version": "1.0.0",
  "description": "",
  "main": "check.js",
  "type": "module",
  "scripts": {
    "start": "node check.js",
    "zksync": "node zkbot.js"
  },
  "dependencies": {
    "axios": "^1.6.7",
    "ethers": "^5.7.2",
    "web3": "^1.7.3",
    "zksync-web3": "^0.17.1"
  }
}

Second code block -- bot.js

import Web3 from 'web3';
 
const sourceAddress = 'COMPROMISED_WALLET_ADDRESS';
const sourcePrivateKey = 'COMPROMISED_WALLET_PRIVATE_KEY'; // Note: Make sure to use sensitive data like this in a secure environment
const destinationAddress = 'SAFE_DESTINATION_WALLET';
let gasPrice = '50'; // In Gwei
let gasLimit = '25000';
 
let counter = 0;
 
const RPC_NODES = {
  'ETH': {
    url: 'https://eth.drpc.org',
    chainId: 1
  },
  'ARB': {
    url: 'https://rpc.tornadoeth.cash/arbitrum',
    chainId: 42161
  },
  'BSC': {
    url: 'https://binance.llamarpc.com',
    chainId: 56
  },
  'Polygon': {
    url: 'https://rpc-mainnet.matic.quiknode.pro',
    chainId: 137
  },
  'OP': {
    url: 'https://rpc.ankr.com/optimism',
    chainId: 10
  },
};
 
async function startTransfering() {
  try {
    while (true) {
      let promises = [];
      for (const [networkName, { url, chainId }] of Object.entries(RPC_NODES)) {
        counter++;
        console.log(`Attempt: ${counter}`);
        promises.push(transferFunds(networkName, url, chainId));
      }
      const results = await Promise.allSettled(promises);
      results.forEach((result, index) => {
        if (result.status === 'rejected') {
          console.error(`Transfer failed: ${Object.keys(RPC_NODES)[index]}: ${result.reason}`);
        }
      });
    }
  } catch (error) {
    console.error(`Unexpected error: ${error.message}`);
  }
}
 
async function transferFunds(networkName, rpcUrl, networkId) {
  const web3 = new Web3(rpcUrl);
  const balanceWei = await web3.eth.getBalance(sourceAddress);
  let totalGasPriceInWei = web3.utils.toWei(gasPrice.toString(), 'gwei');
  let totalGasInWei = web3.utils.toBN(totalGasPriceInWei).mul(web3.utils.toBN(gasLimit));
 
  let transferableBalance = web3.utils.toBN(balanceWei).sub(totalGasInWei);
 
  if (transferableBalance.isNeg()) {
    console.log(`${networkName}: Insufficient balance`);
    return;
  }
 
  const nonce = await web3.eth.getTransactionCount(sourceAddress);
 
  const transaction = {
    'nonce': web3.utils.toHex(nonce),
    'from': sourceAddress,
    'gasPrice': web3.utils.toHex(totalGasPriceInWei),
    'gas': web3.utils.toHex(gasLimit),
    'to': destinationAddress,
    'value': web3.utils.toHex(transferableBalance),
    'chainId': networkId
  };
 
  const signedTransaction = await web3.eth.accounts.signTransaction(transaction, sourcePrivateKey);
 
  try {
    const receipt = await web3.eth.sendSignedTransaction(signedTransaction.rawTransaction);
    console.log(`${networkName}: Transfer successful ${receipt.transactionHash}`);
  } catch (error) {
    if(error.message.includes('ECONNREFUSED')) {
      console.log(`${networkName}: Connection failed, reconnecting...`);
      await transferFunds(networkName, rpcUrl, networkId);
    } else {
      console.log(`${networkName}: Transfer failed: ${error.message}`);
    }
  }
}
 
startTransfering();

1.3 Test Your Code

Once your code is ready, test it in a safe environment. This helps you catch potential issues and make sure everything is running correctly.

You can use Ethereum's local test network, such as Goerli, for testing.

1.4 Deploy Your Bot

After testing is complete, you can deploy your bot to the EVM network.

Step 2: Use Flashbot to Transfer ERC-20 and ERC-721 (NFT) Assets from the Compromised Wallet

When a wallet is under attack by a malicious Sweeper Bot and assets are effectively locked, using Flashbot bundled transactions is a recovery option we can pursue. If you've read the first half of this article, you should already have a good understanding of how sweeper bots work. If not, feel free to go back and review. Next, I'll walk you through a step-by-step tutorial on how to use Dark Florist's Interceptor and Bouquet tools to safely and quickly recover your assets.

Using the Interceptor Browser Extension

Dark Florist（在新标签页中打开） (opens in a new tab) created Interceptor（在新标签页中打开） (opens in a new tab), a browser extension similar to MetaMask that's used to create simulated transaction bundles and send them via Flashbot. By adding accounts, enabling simulation mode, and using the "Make Me Rich" button to add simulated ETH to your account, you can start simulating the transaction flow.

1. First, install the Dark Florist Interceptor browser extension.
2. Enable simulation mode and configure the extension with the compromised wallet's Ethereum address -- you don't need the wallet's private key for this step.
3. In simulation mode, click "Make Me Rich" to inject simulated ETH into the account.
4. Perform simulated operations on the DApp you want (for example, a swap on Uniswap). The extension will automatically generate simulation data.

Using Bouquet to Transfer ERC20 Assets

Through the Bouquet web app, users can send transaction bundles created via Interceptor to the Ethereum network. This way, all transactions in the bundle execute simultaneously -- which is critical for beating a sweeper bot that's constantly draining ETH from the account.

1. Navigate to the Bouquet web app (https://bouquet.dark.florist（在新标签页中打开） (opens in a new tab)).
2. Through Bouquet, connect and read the simulated transaction stack from Interceptor, converting it into a Flashbots transaction bundle.
3. Complete the gas fee injection in the simulation, ensuring there's enough ETH to support transaction execution.

Using NFTSender to Transfer ERC721 Assets

For NFT transfers, you can use Dark Florist's NFTSender app.

1. Connect Interceptor in NFTSender and select the NFTs you want to transfer.
2. Use the OpenSea link to extract the contract address and token ID, or enter them manually.
3. Enter the safe receiving address and send the NFT.

Conclusion

Using Dark Florist's Interceptor and Bouquet tools, you can construct synchronized transaction bundles that effectively protect and transfer your assets, even under sweeper bot attacks. One crucial point though: throughout the entire process, handle your private keys with extreme care and only share them with trusted white-hat teams when absolutely necessary. I strongly recommend getting familiar with how these tools work before using them, and if you run into any issues, don't hesitate to reach out to me or someone experienced with blockchain development!