my web3 wallet got compromised. i signed a malicious contract. no clever scheme here, i just signed it like everyone does, without reading. and sat like that for over a month before i found out. the whole time someone (or his bot) was in my wallet with me. delegation and all, the same access i had. first thing i wanted to do was move everything to a fresh address, fast. tried it. the funds landed on his side the same minute. same access, and a bot is faster than a human. so i stopped rushing. sat down and wrote a script in one evening. first pass was just analysis: what was left, on which networks, what actually transfers, and what is soulbound to the address forever. then the script collected everything that moves and pulled it out in a single go. not one transaction at a time, all at once, so there was no window to squeeze into. it worked. out of 100+ nfts the only ones i could not save were the @layer3xyz ones i had been farming long ago . so the only thing he inherits is proof that i spent a month clicking quests. hope he is proud like @brandonkumar is some of it is still in long vesting. unlocks eventually. we wait together. what i took away: a private key is not a password, you do not change it. the address is dead permanently speed is not your edge. you win by moving once inventory first, movement second. half of what looks like assets does not transfer at all gas is its own trap. the native token gets drained first, so funding and withdrawing have to happen in the same pass every pause between transactions is a window revoking approvals is pointless while he holds the key cold for holdings, a separate hot wallet for clicking on everything an evening on a script instead of five minutes of panic. cheaper that way. now time to rest.