Original language : English
Date : Wed 04 Nov 2026 09:55:01
Project : Sat Rescue
Author : Hidden
Risk : High
Category : software
Sat Rescue - getting your stuck sats back

satrescue.app bills itself as a free, non-custodial web tool that helps you pull out the BTC that wallets like UniSat and Xverse show as "unavailable balance" — because those sats are sitting in UTXOs together with an inscription or a rune. The tool's author (nicknamed OculusMan) started the thread on Nov 1, 2026 — [Tool] Recover BTC stuck as "unavailable balance" in Ordinals/Runes wallets. The pitch there: your keys never leave your device, you sign the PSBT yourself, and the service takes a 17% fee off the recovered amount, paid as a separate output in the same transaction.

According to albon, the page's code has a hardcoded BTC address — bc1qhn047jlj79zwrtk6h54eeyqn9czprghnkdm3m9 — and that's where the 17% fee goes. His main gripe is Burn Mode: he says it grabs every confirmed UTXO in the wallet, which means it can send off not just "dust" but your whole balance, inscriptions and runes included. He also flags an affiliate program: 30% of the service fee goes to whoever brought the user in through a referral link. On top of that, albon points out that the satrescue.app domain was registered on November 1, 2026 — the very same day the first post went up — and the account itself carries a "reawakened after long inactivity" tag, plus two negative feedback entries from 2020 from users SPQRCoin and diks for running multiple accounts. He attached the code snippets from his post as screenshots:

 

He also says that after his negative review he got insults in his DMs instead of a discussion of his findings, and shows a screenshot of the message.

Archive of the GitHub repo: [3]

I opened both the archived copy and the current code in the repo. The config really does have FEE_ADDRESS with that exact address, FEE_PERCENT 17 and REF_PERCENT 30 hardcoded in — and a code comment makes clear that the referrer's cut comes out of the service fee, not on top of it, so the customer pays the same either way. There's also a DUST_MAX parameter set at 3000 sats — that's the threshold used to pick out "dusty" outputs in normal mode. In burn mode, the selection is drawn from the full list of confirmed UTXOs, not the threshold-filtered ones; after the Nov 3 fix (commit 931c120), inscriptions and runes no longer go into the transaction by default and only get included via a separate checkbox with a warning. Signing and broadcasting go through signPsbt and pushPsbt, just like the report says. So the technical side of albon's complaint about burn mode and the fee basically matches what you can see in the code — whether it's actually "dangerous" is a matter of interpretation.

In an update, albon writes that the domain ended up on MetaMask's blocklist after he reached out.

The blocking request is [#308358], where maintainer AlexHerman1 replied "scheduled for blocking" on Nov 2. Worth noting: that issue honestly spells out that the referrer's cut comes out of the service fee rather than being added on top, and that the filer couldn't figure out who actually controls the fee address.

The tool's author then opened [#308671] asking for the block to be lifted, and in user OLDasGOLD's opinion this is no false positive: the problems in the code are still there, and being open-source and non-custodial doesn't automatically make a tool safe. Responding to the "we fixed the inscriptions" argument, OLDasGOLD pointed out that burn mode can still grab regular, non-dust UTXOs, and that the questions about the hardcoded fee address, the 17%, and the 30% referral cut went unanswered. Then [#309013] showed up describing commit 931c120, and MetaMask maintainer AlexHerman1 closed it as not planned. The tool's author replied that nobody would use the site with a full-screen red banner, and asked to work out a deal to get it delisted.

satrescue.app is still on MetaMask's blocklist — I checked the current eth-phishing-detect config. Per RDAP, the domain was registered on Nov 1, 2026 at 21:04 UTC, registrar Cloudflare, NS also Cloudflare, paid up until Nov 1, 2027, status "add period". The fee address is alive on-chain: 54 transactions, 53 outputs came in totaling roughly 66,609 sats, 52 of which have been spent, leaving a balance of about 2,775 sats. So the amounts flowing through the fee are tiny so far.

The tool is open and non-custodial, it really doesn't ask for your keys, the fee is visible in your wallet before you sign, and the amounts that went through the fee address are pocket change. But: the domain was just one day old when the thread went up, there's a hardcoded fee recipient with zero explanation, burn mode works with all confirmed UTXOs and not just dust, and there's a confirmed block on MetaMask's blocklist. Those are reasons enough not to hook up your main wallet with a serious balance and collectibles. If you still want to give it a shot, the smart move is to do it from a separate wallet with nothing valuable in it, and eyeball the transaction outputs before you sign.

domain explore registered registrar abuse email score average
satrescue.app Nov. 1, 2026 CloudFlare, Inc. [email protected] 33/100 33.0
Blacklist: NoCoin Hexxium QuidsUp URLhaus FadeMind MetaMask Phishunt Badd-Boyz BlackBook CoinMiner OpenPhish ThreatFox TweetFeed PhishRadar Scam Block Abuse Block Phishing DB ScamSniffer PhishDestroy Malware Block Phishing Army Toxic Domains Filters Heroes GlobalAntiScam Phishing Block Pi-hole Trojan Scam Blocklist Fraud Blocklist Pi-hole Malware Crypto Blocklist Pi-hole Phishing Ransomware Block CyberHost Malware Pi-hole Malicious Pi-hole C2 Servers Thread Intelligence PhishDestroy Community
address network info score average
bc1qhn047jlj79zwrtk6h54eeyqn9czprghnkdm3m9 BTC 33 33.0
Blacklist: Scam DB Badd Boyz Scam Breaker Scam Sniffer Scam Dataset A7A5 Blacklist PublicAML Hack PublicAML Scam My Ether Wallet PublicAML Mixer Circle Blacklist Tether Blacklist PublicAML Darknet PublicAML Phishing PublicAML Sanction PublicAML Ransomware Office of Foreign Assets Control

source

https://bitcointalk.org/index.php?topic=5598755.0

https://bitcointalk.org/index.php?topic=5598589.0

Trust Rating

33
67
Suspicious Reply