Which Transaction Removed the New Gas or the Existing Tokens?
If newly added ETH, SOL, BNB or another native asset disappears, do not add more. Open the explorer and identify the outgoing transaction. A normal transaction can consume gas, a malicious token spender can move approved tokens, and a sweeper with the private key can transfer the newly deposited native coin almost immediately. These are different incidents with different remedies.
Most faucet rewards are tiny. FaucetPay can help you collect small payouts from supported faucets, PTC sites and reward platforms in one microwallet before withdrawing later.
Set up FaucetPay to collect small rewards →Use the Gas-Arrival Forensics Table
Record the first outgoing event after the gas deposit.
- Outgoing asset: native coin, token or NFT
- From address and signer
- Recipient or spender
- Transaction type and method
- Nonce and time after deposit
- Whether the user confirmed anything
- Remaining approvals and balances
Case 1 — the wallet paid a transaction fee
If the user intentionally submitted a transfer, approval, swap, revoke or failed contract call, the native balance can fall because blockchain gas was consumed. Open the transaction, compare the signer and method, and calculate fee separately from transferred value.
A failed transaction can still consume gas
On EVM networks, validators execute the attempted call even when the contract later reverts. The token or swap result may be absent while the gas fee remains spent. This is not evidence of a sweeper when the user signed the matching transaction.
Case 2 — a malicious approval moved tokens
An ERC-20 spender can call transferFrom using an existing allowance and pay gas from the attacker’s account. The victim’s new ETH is not required for that spender transaction. Check token Transfer events, the spender contract and the allowance history.
Why the timing can still appear linked to adding gas
The user may add gas and immediately attempt a revoke, swap or rescue, revealing the wallet to an attacker or submitting another malicious call. The token loss can occur in the same minute without the attacker needing the deposited gas.
Case 3 — the native gas coin itself was swept
When the newly deposited native asset leaves from the wallet address in an unauthorized signed transaction, private-key or recovery-secret compromise is the leading explanation. Phantom and MetaMask describe sweepers as scripts that monitor incoming funds and transfer them faster than a human can react.
A token approval cannot transfer native ETH by itself
ERC-20 allowance covers the specified token contract, not the account’s ordinary ETH balance. An unexplained ETH transfer signed from the wallet points to key control, a malicious transaction the user signed or account-level smart-wallet authority—not a standard token approval alone.
Case 4 — the balance is reserved or displayed on another network
A pending transaction can reserve funds in the wallet interface, and the same address can hold different native balances across EVM chains. Verify the explorer balance on the selected network before assuming an outgoing theft occurred.
Stop the top-up loop
Do not send another small deposit to test whether the first loss repeats. MetaMask and Phantom both warn that additional funds sent to a sweeper-controlled wallet are likely to be taken. Each test can become another irreversible loss.
Preserve the incident evidence
Save the gas deposit TXID, first outgoing TXID, attacker address, token contracts, approvals, wallet version, device, suspicious domains and exact time. Do not expose the seed phrase while asking for help.
If only an approval is confirmed
Disconnect suspicious sites and revoke the token or NFT authority using the wallet or a trusted chain-specific tool. Verify the remaining allowance on-chain. Move directly exposed valuable assets when drain activity is ongoing or the spender is malicious.
If a permit signature is confirmed
Identify the token, spender, amount, nonce and deadline in the signed data. Permit-style authority may not appear as an approve transaction at signing time. Cancel or revoke through the relevant protocol where possible and move assets if the authorization can still be executed.
If the recovery secret is exposed
Create a completely new wallet with a new seed or key on a clean device. Do not create another account under the compromised phrase. Transfer any recoverable assets only through a carefully planned method; ordinary top-ups can feed the sweeper.
Clean the device before creating the replacement wallet
Remove unknown extensions and applications, run malware checks, update the operating system and secure the email or cloud accounts that stored wallet data. A fresh seed created on a compromised device can be stolen again.
Do not trust recovery agents promising certainty
Confirmed blockchain transfers are generally irreversible. Public replies and direct messages offering guaranteed recovery frequently become a second scam. Advanced private-bundle rescue can be network-specific, technically demanding and never guaranteed.
Worked legitimate fee case
The user adds ETH and submits a token approval that later reverts. The explorer shows the user’s address, chosen contract and a gas fee but no unauthorized transfer. The balance fell because the signed transaction consumed gas.
Worked allowance-drain case
USDC leaves through transferFrom from an approved token contract, and the attacker transaction is paid by another address. The victim’s ETH remains. The response is approval review and asset protection, not repeated gas deposits.
Worked sweeper case
A small SOL deposit is followed within seconds by an outgoing SOL transfer the user never signed. The same pattern repeats. The wallet is abandoned, a new recovery secret is created on a clean device and no more SOL is sent to the compromised address.
The incident verdict
A matching user transaction means fee or contract failure. A spender-driven token transfer means approval or permit abuse. An unauthorized native transfer from the wallet means key or account control. Respond to the highest proven authority and stop adding funds until it is contained.
Sweeper and approval references checked on July 30, 2026
Current wallet-provider documentation supports the distinction between gas consumption, token authority and key-controlled automated sweeping.
- MetaMask sweeper-bot response: https://support.metamask.io/stay-safe/protect-yourself/fighting-back-against-sweeper-bots/
- Phantom sweeper-bot warning: https://help.phantom.com/hc/en-us/articles/40330224994067-Beware-of-sweeper-bots
- Phantom drained-wallet response: https://help.phantom.com/hc/en-us/articles/5487893286291-I-was-scammed-or-my-wallet-was-drained-What-can-I-do
- MetaMask token allowance revocation: https://support.metamask.io/more-web3/learn/how-to-revoke-smart-contract-allowances-token-approvals/
- ERC-20 approval and transferFrom standard: https://eips.ethereum.org/EIPS/eip-20
Be careful with websites that promise unrealistic rewards, ask for deposits before withdrawal, or require suspicious wallet connections. Small reward sites should never need your seed phrase.
FAQ
Why does newly added gas disappear immediately?
An unauthorized native transfer strongly suggests a compromised key or sweeper, though the explorer must identify the actual outgoing transaction.
Can a token approval steal my ETH?
A standard ERC-20 approval covers that token, not ordinary ETH. Native-coin loss requires another authority or signed transaction.
Should I add more gas to revoke approvals?
Not blindly. First determine whether a sweeper controls the key and plan a safe network-specific response.
Can a failed transaction empty part of the gas balance?
Yes. A reverted on-chain call can consume the fee even though the intended action failed.
Can the old wallet be trusted after seed exposure?
No. Create a new wallet with a new recovery secret on a clean device.