Drain alerts for bot and agent wallets (waitlist)
We're planning Telegram alerts for the wallets that trading bots and AI agents use. You'd give us public wallet addresses only, never keys, and we'd message you within seconds when one of them shows the signs that came before or during real drains: test transfers, sweeps, malicious approvals and signatures, EIP-7702 delegations, Solana owner changes, address poisoning, sweeper bots and many wallets on one bot being hit at once. It isn't built yet: this page is a waitlist, so we can see if enough people want it.
Join the waitlistOr send /alerts on Telegram
What it would watch
- Funds leaving in a sweep. Most of a wallet's balance, or several tokens one after another, going to the same new address in a short time. That is what a drainer does once it has a key.
- Tiny test transfers. A small amount sent out first, to check that a stolen key works, before the real sweep.
- New token approvals to unknown contracts (Ethereum, Base, Arbitrum, BNB Chain). An approval lets a contract move your tokens later without asking you again.
- Permit and Permit2 transfers. A signature you gave on a website being used to move your tokens. Signatures are invisible until they are used, so this alert fires the moment one is used onchain, and the daily scan lists open Permit2 allowances.
- Known drainer addresses. Any approval, delegation or transfer that involves an address or contract on public drainer and phishing lists, such as the ones security firms and wallet makers publish.
- New EIP-7702 delegations to unknown contracts (same chains). A delegation points your wallet at a contract's code, which can then act as your wallet (EIP-7702).
- Solana owner and authority changes. If the owner permission of your wallet, or the authority of one of your token accounts, is changed to another address, that address controls those funds. These transactions often show no balance change, so they are easy to miss.
- Sweeper bots. Funds that arrive and leave within seconds to the same address, again and again. That usually means a bot already has the key: stop sending money to that wallet.
- Address poisoning. A tiny or zero-value transfer from an address that looks like one you use, so you copy the wrong one from your history next time.
- Cross-wallet warnings. If several wallets that use the same bot are being drained at the same time, everyone on the list who uses that bot hears about it, even before their own wallet is touched.
- A daily exposure scan. Once a day, the open token approvals and delegations on your wallets, each with a Revoke.cash link so you can remove the ones you don't need.
The patterns behind real drains
Drains don't all look like the Bloom sweep. These are the patterns that show up again and again, a real case for each, and what would alert you.
| Pattern | Real case | What would alert you |
|---|---|---|
| Test transfer, then sweep | Oct 26, 2026: Bloom says 49 wallets of 9 users lost about 9,408 SOL; it says it refunded all of it (Bloom) | The tiny test transfer, the sweep, and a warning to other wallets on the same bot |
| Malicious signature on a fake site | Sep 28, 2024: a wallet lost about $32.4M in spWETH after apparently signing a malicious transaction linked to Inferno Drainer (The Block) | The approval or permit being used, and the transfer to an address on drainer lists |
| EIP-7702 batch phishing | 2025: Scam Sniffer reported a victim who lost about $1.54M after signing a batch on a fake DeFi site that hid several transfers (summary) | The new delegation and the outgoing transfers in the same transaction |
| Sweeper bots on leaked keys | May 2025: Wintermute found over 97% of EIP-7702 delegations pointed to copies of sweeper contracts that drain incoming ETH from wallets with leaked keys (Cointelegraph) | The sweeper pattern and the delegation |
| Address poisoning | May 3, 2024: a trader sent 1,155 WBTC (about $68M) to a lookalike address; the funds were later returned (Cointelegraph) | The poisoning transfer when it lands in your history |
| Solana owner change | Dec 2025: SlowMist reported a Solana user lost more than $3M after a deceptive signature changed the wallet's owner permission; the transaction showed no balance change (Coinpaper) | The owner change itself |
| Many wallets at once | Oct 17 to 18, 2026: Qubic says 1,404 wallets were drained in about 104 minutes because some seeds were generated with too little randomness (Qubic) | A cross-wallet warning to everyone with wallets of the same kind |
What it can and can't do
The honest limit: if a thief already has your private key, an alert can't stop the sweep. The transfers are signed with your key and final once they're onchain. Nothing we send you can undo them.
Where an alert can still help:
- Catching setup steps early. Test transfers, new approvals and new delegations can come before the main theft. Seeing them gives you a chance to revoke or move funds first.
- Protecting your other wallets. If one wallet is hit, you hear about it fast and can empty the wallets that share the same bot, seed phrase or device.
- Early warnings across the platform. When wallets that use the same bot are drained at once, you can pull funds out before your own wallet is reached.
It would not hold or ask for keys, sign or block transactions, catch every drain, or get stolen money back.
Privacy
- Public addresses only. Alerts would work from public wallet addresses, the same data anyone can see in a block explorer. Never send a private key or seed phrase to anyone, including us. We will never ask for one.
- What the waitlist stores. Your email, the chains, bots and number of wallets you pick, the price you pick, the page you came from, your country (from Vercel's request headers) and the time. It is kept in our Upstash Redis database and a copy is emailed to us through Resend. We don't ask for wallet addresses on the waitlist.
- What it's used for. To email you once when drain alerts are ready and to decide whether and how to build them. Ask hello@tradingagentstack.com to remove your entry.
- On Telegram,
/alertsstores your chat id only, so the bot can message you once when it's ready.
Join the waitlist
A few quick questions. Your answers tell us which chains and bots to support first and what it should cost.
Prefer Telegram? Message @TASCheckBot with /alerts. It replies with what's planned and messages you once when it's ready.
What you can do today
- Check a bot, exchange or wallet before you connect it on TAS Check: is the link official, who holds the key, what's the worst case.
- Keep only trading money in any wallet a bot can touch, and keep long-term holdings in a separate wallet.
- Review and revoke token approvals you don't use with Revoke.cash.
- Running an AI agent with an EVM wallet? TAS Guard's onchain mode adds spending limits and approval from your phone before a transaction is sent.
- Already drained? Follow what to do if a bot or wallet is drained.
FAQ
Is it live?
No. Drain alerts are planned, not built. Nothing on this site watches your wallets today. Join the waitlist and we'll tell you once when it's ready.
Do you need my private key or seed phrase?
No, never. Alerts would work from public wallet addresses only, the same data anyone can see in a block explorer. Anyone who asks for your key or seed phrase is scamming you.
Can an alert stop a drain?
Not once a thief is using your stolen key: the transfers are signed and final. An alert helps before that (test transfers, new approvals or delegations) and after it (moving funds out of your other wallets).