Recovering assets from a dashboard wallet

import {PrivyClient} from '@privy-io/node';
import {Connection, PublicKey, Transaction} from '@solana/web3.js';
import {
  getAssociatedTokenAddress,
  getAccount,
  createTransferInstruction,
  createAssociatedTokenAccountInstruction
} from '@solana/spl-token';

const privy = new PrivyClient({
  appId: process.env.PRIVY_APP_ID!,
  appSecret: process.env.PRIVY_APP_SECRET!
});

const walletId = 'insert-wallet-id';
const connection = new Connection('insert-your-rpc-url', 'confirmed');

const from = new PublicKey('...'); // the wallet's address
const to = new PublicKey('...'); // the destination address
const mint = new PublicKey('...'); // the SPL mint to recover

const fromTokenAccount = await getAssociatedTokenAddress(mint, from);
const toTokenAccount = await getAssociatedTokenAddress(mint, to);

// Read the full balance so the entire position is recovered
const {amount} = await getAccount(connection, fromTokenAccount);
if (amount === 0n) throw new Error('Nothing to recover');

const transaction = new Transaction();

// The destination needs a token account for this mint before it can receive the transfer
if (!(await connection.getAccountInfo(toTokenAccount))) {
  transaction.add(createAssociatedTokenAccountInstruction(from, toTokenAccount, to, mint));
}

transaction.add(createTransferInstruction(fromTokenAccount, toTokenAccount, from, amount));

transaction.feePayer = from;
// Privy populates the real blockhash when given this dummy value
transaction.recentBlockhash = '11111111111111111111111111111111';

const {hash} = await privy
  .wallets()
  .solana()
  .signAndSendTransaction(walletId, {
    caip2: 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
    transaction: transaction
      .serialize({requireAllSignatures: false, verifySignatures: false})
      .toString('base64')
  });

console.log('Recovery transaction:', hash);