Rescue operations for assets stuck in a compromised wallet (0xed9198...0c4e / scapes.eth). The wallet had a sweeper bot that drained any incoming ETH within seconds, so all rescue operations use Flashbots bundles to atomically fund, execute, and sweep in a single block — invisible to the mempool.
The wallet had been dormant since July 2023. The private key was compromised at some point, and a sweeper bot (0x1cc87a77... + related 0x1cc8... variants) was deployed against it.
21:18 UTC — The bot drained everything in three blocks:
| Asset | Amount | ~USD (@ $2,000/ETH) |
|---|---|---|
| ETH | 2.957 | $5,914 |
| WETH | 4.003 | $8,006 |
| ENS tokens | 393.6 | ~$3,936 (@ ~$10/ENS) |
| Opepen #6557 | Sold via Seaport | ~$163 |
| Total lost | ~$18,019 |
The initial drain transaction used 7,410 gwei gas and landed at position 0 in the block — classic sweeper bot signature. The bot then continued monitoring: any ETH sent to the wallet was swept within 12 seconds.
Sent 0.01 ETH to the compromised wallet to fund ownership transfers. The bot swept it 12 seconds later. The ownership calls never had gas to execute.
One Flashbots bundle, one block — transferred ownership of 11 contracts:
Scapes, TwentySevenYearScapes, Gallery27 V1, Gallery27 V2, Scape Elements, Scape Extensions, PunkScape Relics, Branches, Speech, GMs, OneDayPunks
Follow-up acceptOwnership calls for the two Ownable2Step contracts (Scapes, Scape Extensions).
With ownership transferred, the new wallet called withdraw on both Gallery27 contracts directly (no bundle needed):
| Contract | ETH | ~USD |
|---|---|---|
| Gallery27 V1 | 7.294 | $14,588 |
| Gallery27 V2 | 0.7559 | $1,512 |
| Total | 8.0499 | $16,100 |
One bundle — withdrew 0.4415 ETH (~$883) from Blur Pool and sent it to the new wallet.
One bundle — transferred 5 ENS domains via safeTransferFrom:
gallery27.eth, punkscapes.eth, punkscape-community.eth, scape.eth, diptych.eth
Follow-up reclaim calls to update ENS controller records.
| Asset | Details |
|---|---|
| 11 contract ownerships | All Scapes project contracts |
| 8.0499 ETH | ~$16,100 from Gallery27 V1/V2 unclaimed funds |
| 0.4415 ETH | ~$883 from Blur Pool |
| 5 ENS domains | gallery27.eth, punkscapes.eth, punkscape-community.eth, scape.eth, diptych.eth |
Double-checked ownership of OpenSea collections — now in control of the new wallet.
After every bundle, the sweeper bot still drained residual dust (~0.003–0.006 ETH), but the valuable assets were already safe.
| Address | |
|---|---|
| Compromised wallet | 0xed9198...0c4e |
| New wallet | 0xb54af9...5f1 |
| Sweeper bot | 0x1cc87a...2b0 |
Hardhat 3 + viem + Flashbots (relay + multiple block builders). All tasks support --simulate-only and fork mode for dry runs.