Wallets & Self-Custody How Automated Wallet Sweeps Save Compromised Funds Owen Gaines Owen Gaines is a professional poker player and author who has played an estimated ten million hands and written four poker strategy books. October 15, 2026 When a private key or seed phrase leaks, the wallet does not lock or alert the owner. Anyone holding the key can sign transactions, and attackers usually automate the theft with scripts that move funds out the moment they appear. An automated wallet sweep is the defensive counterpart: a prepared process that moves remaining assets to a clean wallet faster than the attacker can take them, or that limits how much is ever exposed in the first place. For crypto poker players, this matters because deposit and withdrawal wallets are hot by design. They sign transactions often, connect to more software, and are the most likely place for a key to leak. A sweep cannot undo a theft that has already happened, and a rescue can fail. This guide explains how compromise plays out on-chain, how scheduled and emergency sweeps work, why public rescue attempts often fail, and how players structure wallets so that a leaked key costs as little as possible. The focus is security mechanics, not guarantees. What Happens When a Wallet Is Compromised A blockchain cannot distinguish the owner from an attacker. Both hold the same key, and whoever gets a transaction confirmed first controls the funds. Attackers rarely drain manually. They run sweeper bots that watch the compromised address and broadcast a transfer within seconds of any new balance. On Ethereum and other EVM chains, this creates a trap: tokens such as USDT or USDC cannot be moved without ETH for gas, and any ETH the owner sends to pay that gas is swept before it can be used. The scope of a leak also matters. A single exposed private key compromises one address. An exposed seed phrase compromises every address derived from it, across every chain the wallet supports. How Automated Sweeps Work Defensive sweeps fall into two categories: scheduled sweeps that reduce exposure before anything goes wrong, and emergency sweeps that try to recover assets after a compromise. Scheduled Exposure Sweeps A scheduled sweep moves any balance above a set threshold from a hot wallet to cold storage on a fixed interval or trigger. The hot wallet holds only what the next few sessions require. If its key leaks, the loss is capped at that working balance rather than the full bankroll. Emergency Rescue Sweeps A rescue sweep moves everything still recoverable to a new wallet generated from a fresh seed. It must handle every asset at once, because each separate transaction gives the attacker’s bot another chance to act. Why Public Rescues Fail Transactions broadcast to the public mempool are visible before confirmation. A sweeper bot sees the rescue, copies its intent, and outbids it with a higher fee. On EVM chains, the owner’s gas funding is swept before the token transfer executes. Successful rescues therefore avoid the public mempool entirely. What This Means for Crypto Poker Wallets Rescue feasibility depends on what leaked and which chain holds the funds. Compromise Type Attacker Capability Rescue Feasibility Required Action Single private key Signs for one address Possible if remaining assets are moved privately and atomically Rescue sweep, then retire the address Seed phrase Signs for every derived address on every chain Partial at best; the attacker can act on all addresses at once New seed, sweep all chains, retire the old seed Malicious token approval Spends approved tokens only; no key access Good if the approval is revoked before it is used Revoke approvals; key itself may still be safe Exchange or poker account login Account-level actions, not on-chain keys Handled by the platform, not by a sweep Contact support, reset credentials, enable 2FA A poker account and a self-custody wallet are separate systems. If a withdrawal is pending to an address that has since been compromised, the urgent step is contacting support before withdrawal processing completes, so the request can be cancelled and resubmitted to a clean address. Common Mistakes Players Make Sending ETH to a compromised address to pay gas for a token transfer, which simply feeds the attacker’s bot. Moving funds to a new address from the same seed, which leaves them exposed to the same leaked phrase. Searching for “recovery services” online and sharing the seed with a second party, which is a common follow-up scam. Keeping the full bankroll in the wallet used for deposits, so a single leak exposes everything. Advanced Rescue Mechanics Private Transaction Bundles On Ethereum, rescues typically use private relays that submit a bundle directly to block builders. The bundle funds gas from a clean wallet and transfers the tokens out in the same block, executed in order or not at all. Because it never enters the public mempool, the sweeper bot has nothing to react to. Bitcoin Fee Competition Bitcoin has no gas-token trap, since fees are paid from the coins being moved. The race happens in the mempool instead. Replace-by-Fee lets either party rebroadcast a conflicting spend with a higher fee, so a contested sweep can escalate into a bidding war where miners collect most of the value. A high initial fee rate matters most; check mempool.space for current rates. Account Delegation Risks Ethereum’s 2025 Pectra upgrade let standard accounts delegate execution to smart contract code. Attackers have used this to install automatic draining logic on compromised addresses. Rescuers must check for an existing delegation first. Rescuing Stablecoins From a Compromised Deposit Wallet A player discovers that the ETH in their deposit wallet was drained overnight. The stablecoin balance is still there. Remaining assets: USDC equal to roughly 8-10 average buy-ins; zero ETH A sweeper bot is active: a small test amount of ETH sent earlier vanished within one block The seed phrase is the suspected leak, so every derived address is treated as compromised A withdrawal from the poker account to this wallet is still pending The Technical Process The player first contacts poker support to cancel the pending withdrawal. A new wallet is created on a clean device with a fresh seed. A bundle is then submitted through a private relay: one transaction sends gas from a separate clean wallet, the next transfers the USDC to the new address. Both execute in the same block or not at all. The Outcome The USDC reaches the new wallet, and the pending withdrawal is resubmitted to the clean address. The ETH stolen overnight is not recoverable. Public-mempool attempts would each have been swept. How Professionals Limit Sweep Exposure Experienced players design wallets so that any single leak is survivable. Technical Risk Management They use separate seeds for deposit wallets and long-term storage, keep the deposit wallet’s balance close to one or two sessions of buy-ins, and sweep excess to a hardware wallet on a schedule. Withdrawal addresses are whitelisted and changed only after verification. System Optimization They review token approvals regularly and revoke unused ones, keep a funded clean wallet ready to pay gas in a rescue, and manage deposits only through the official ACR Poker software cashier rather than links received by message. Technical Evolution in Wallet Recovery Externally owned accounts tie control to a single key, which is why a leak is final. Smart contract wallets change that model with guardians, spending limits, and timelocks that delay large transfers long enough for the owner to cancel them. As these designs mature, emergency sweeps will increasingly give way to built-in recovery. Until then, the most reliable protection in cryptocurrency self-custody remains limiting what any single key controls. Frequently Asked Questions Can stolen crypto be recovered with a wallet sweep? No. A sweep only protects assets that are still in the compromised wallet. Once funds are confirmed in the attacker’s address, they are under the attacker’s control, and blockchain transactions cannot be reversed. A sweep is useful for remaining tokens, coins, and pending claims, provided it executes before the attacker acts. Why does ETH disappear when I send it to my compromised wallet? The attacker is running a sweeper bot that monitors the address and transfers any incoming ETH within seconds. Sending more ETH for gas only feeds the bot. Moving tokens out safely requires a private bundle that funds gas and transfers the tokens in the same block, without passing through the public mempool. Is it enough to move funds to a new address in the same wallet? Not if the seed phrase leaked. Every address derived from that seed is controlled by the same phrase, so the attacker can access the new address as well. Funds must go to a wallet created from a brand-new seed, ideally generated on a clean device or a hardware wallet that was never exposed. What should I do if a poker withdrawal is going to a compromised address? Contact the poker site’s support immediately and ask to cancel the pending withdrawal before it is sent on-chain. Once broadcast, it cannot be recalled. After securing a new wallet, update the withdrawal address, enable two-factor authentication, and resubmit the request to the clean address. Are scheduled sweeps to cold storage worth setting up? For players who keep meaningful balances in a deposit wallet, yes. Moving anything above one or two sessions of buy-ins to a hardware wallet caps the loss from a leaked hot key. The trade-off is extra network fees and a short delay when funds need to move back for play. Should I use a paid recovery service after a wallet compromise? Be extremely cautious. Fake recovery services are a common follow-up scam targeting theft victims, often asking for the seed phrase or an upfront fee. Never share a seed with anyone. Legitimate rescue methods use public tools and do not require handing over control of a new wallet.