Gas disappears immediately after funding a wallet: suspect a sweeper

If newly deposited gas repeatedly leaves your account immediately without your authorization, suspect automated sweeping. Adding more gas can simply increase the loss instead of enabling your planned token transfer.

MetaMask’s sweeper guidance explains that an attacker with signing access can monitor a compromised account and rapidly move new funds. This is different from an ordinary swap fee that appears in the receipt of your own transaction.

Verify the pattern

Inspect the deposits and subsequent outgoing transactions on the correct chain. Compare timing, sender and destination. Do not infer a sweeper solely from a wallet valuation dropping or a fee estimate changing.

If the outgoing transactions are unauthorized, stop using the compromised secret and assess the device or phishing event that exposed it.

Why simple fixes fail

Changing the local wallet password does not replace the private key. Disconnecting websites does not remove the attacker’s signer. Revoking a token allowance does not stop an attacker who can directly sign new transactions.

Creating a second account under the same leaked recovery phrase also does not establish a clean destination.

Get help without compounding exposure

Specialist recovery techniques may exist for particular assets and networks, but there is no universal guaranteed rescue. Use independently verified, reputable assistance and understand the proposed scope before authorizing anything.

Do not run a stranger’s script, pay a claimed mandatory unlock tax or send the recovery phrase to a public support chat. Preserve transaction evidence and prioritize protecting uncompromised accounts while the remaining recovery options are assessed.