Wallet sweeper 0x0103c1d2…: 72 Ethereum wallets emptied, 23 Oct 2026 – 24 Oct 2026

Between 23 Oct 16:36 UTC and 24 Oct 05:42 UTC, 72 Ethereum wallets each sent their entire ETH balance to the same freshly created address, 0x0103c1d20889fF4F334e7A4cd2C4CA9C93802729. Taken together they lost 1.2343 ETH. 51 of them had not been touched for more than a year, the oldest since 2021. 41 were left with exactly 0.00000416 ETH, the same remainder to the wei, which is what an automated sweeper script leaves behind after paying gas. The wallets were funded from unrelated sources and show no sign of one owner moving his own money. This is the signature of private keys or seed phrases that have leaked, and of a script that empties every wallet it holds a key for as soon as it is run.

The same address turns up outside the sweep. An account on a cryptocurrency exchange platform that tried to run fake exchanges while posing as the platform's support staff gave 0x0103c1d20889fF4F334e7A4cd2C4CA9C93802729 as its wallet. The platform did not pay out anything for those fake exchanges.

That account connected from 2a0f:b240:1405:f45c::1, an address in a block registered to GoCodeIT Inc and announced by AS210699 (WeDeploy SAS): a rented server, not a home connection. Geolocation databases place it in Hong Kong. It gave the phone number +1 554 777 6590. Area code 554 is not assigned in the North American numbering plan, so the number is virtual or spoofed.

It also named 0x9858EfFD232B4033E47d90003D41EC34EcaEda94 as a wallet. That is the first address of the public test seed phrase "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about": anyone can derive its key, so it belongs to no one in particular. Offering it shows the same habit as the sweep: working with keys that are not secret.

The same address also collected money from other places: 8.1602 ETH arrived through bridge and swap contracts (Bridgers1.1 (BRIDGERS), DexRouter, Mayan Finance, MulticallHandler); 655.16 USDT came from 0x34e4e1630E155d0e2CEC573445e8fC163572f4f6. Funds bridged in from other chains suggest the same keys were swept there too.

9 other wallets also sent 4.3996 ETH to the address but kept sending transactions of their own afterwards, so they are not counted as swept wallets here: 0x4Bc54a8f2D5d404adBf2662e8629BEb2776067E9, 0xd3C13E03981030204Ba1DD91eB5239C7cC8C4215, 0x8b343919d951e930940c97d8B35a34a57731B02E, 0x7d41597C314e1B85F1B9398C84109eB708f65087, 0x129118B14dA9d3Ed5B2619781DEa3Da3B6a79bE5, 0x0000999f63422Bf73F69a07A118ce2d923999999, 0x0D42EF1d088D412B1945BC36e1F7961A280d7438, 0x0000Edfe7DAdC4d03B1A6F1086E6dB7de8777777, 0x00004C9dddf651c02485C94331F935BCf9999999.

Where the money went: 0.0099 WETH to 0x8feAB81D36E7576107D5dE0758c1b839Be31B4F6 (DexRouter, 24 Oct 06:44 UTC, tx 0xf59b93c858f4d6142ed5fe7046cb349e725cf19dde77c8c321964ea62972098e); 0.0034 ETH to 0x2eB00EC5698cf998a94fABcD88287f5086618416 (an unlabelled wallet, 24 Oct 06:49 UTC, tx 0xdb66e1fe3d7d9f4a6aa23a25973f979266cabe8313bdce72ed4a296b1b0e36d4); 658.99 USDT to 0xC602fa28369f92f964F30D02D0DB42662130180F (BebopAdapter, 24 Oct 06:53 UTC, tx 0x75af54ece4924882d7f72d1243e5ccb1f7ed1015cca58933229556440984f02c); 1.73 ETH to 0xb2bD8780Bd7a62BEEe658d1592EC42CF25460D36 (a ChangeNOW deposit address, 24 Oct 06:58 UTC, tx 0xc35b0773b3915290f729bcb19b065debe17074217949a189607fb461882705d8); 13 ETH to 0x2cb4c3bD32acdCE747F98151adA83d670290672F (a ChangeNOW deposit address, 24 Oct 07:10 UTC, tx 0xa99907c1878c41e3c83e251f2a419eba5e20628cd1b3f15a9c2268753db2c9d8).

PublicAML has labelled 0x0103c1d20889fF4F334e7A4cd2C4CA9C93802729 as a hack collector, so any wallet or exchange that screens it with PublicAML sees a critical risk score, and the exchange deposit addresses that received the proceeds carry a stolen-funds label. Exchange hot wallets are not labelled.

If your address is in the list below, assume its private key or seed phrase is known to someone else. Do not send anything more to it. Move any remaining tokens and NFTs to a new wallet created with a new seed phrase, from a clean device. Keep the sweep transaction hash: the exchange that received the funds and the police will ask for it.

Sweep transactions, one per wallet: 0x66735D689Dd1530410349Da0560354b80b88219b sent 0.063461 ETH in tx 0xde6687d3cbf3205149b243282ce1020a33738ad96fd8b62b2fadbc356ea48166; 0xe84b6Fc89527002627e42bBF59AE7213706499F8 sent 0.072249 ETH in tx 0x7c916cabf34faeb018ab671f4565824e57145aed0bd95946b69ede6225071f0a; 0x507a2912d3BEDDF56Efa3352F3502661c04139a2 sent 0.000721 ETH in tx 0x3631561fc5bede78abb9875a6d854aeeaaf98b0a90f4635e63ae7f97b406d2c0; 0xe91AeF3D80A59a4A9FC48B39422220827cf25234 sent 0.050895 ETH in tx 0x8b55aecf6a4a6376ab60dbff7f61f22ed62f1285fbee9f337076149d9dca52cc; 0xa568465D7C841CC3196308bE6b33AFE0E8a7d00A sent 0.025476 ETH in tx 0xd026c1ced9cd05e8fd7eb3bb46825fae10ee81ab92999acc498da4d3c8a676a4; 0x035052FB1d0a1E14BcbC928A25925220C53F6aD8 sent 0.005877 ETH in tx 0xe63c812e3c2c831a06ad10d3dc44dab604e0e2d2c2f595e0bc61a9880ef83308; 0x2648A9CB5C94550bA6b25f0D84460C755F2efB67 sent 0.017817 ETH in tx 0x97409afe810b0b0ef2fd7ec7245a270c009b752f1e1bceb3d4336e8afc48855e; 0x271DB18487624589E4434FC028BCCdc5D57B6688 sent 0.111415 ETH in tx 0xa2ac813c56ef8724a47eab6a9fbc1ad75f75647d5075bcae754492a7d96515a5; 0x2fDC75dDE78eFf102Fd70285987E62f58826E3a8 sent 0.009555 ETH in tx 0xd608d47a18d268a7b686f9afe2deb3f89a7edffb236bba413bbe63e0378b652f; 0x3049CE6c595D4593c9a52b5A17b56E1263A06937 sent 0.006756 ETH in tx 0x39d7c0ae7d4d61da4da7e16cff2c791d49bcfe4f4db9aab35627163bb36974e8; 0x380A3b8d7e3C5a71d2Fd4E9Dd614671723fe6ea8 sent 0.009992 ETH in tx 0x0df6fee70436e55eb1fa9a5dc9f7b11bc3fff045ce5ed0c5d56974074c1f1872; 0x43646B4bF2f38314843310Eec010e7400CD87e58 sent 0.015063 ETH in tx 0x70fa05cae09fdd2e35cbb6e086b044c76c798af49abf7f61a3bd15d9b8072cd6; 0x4AAa842f13c28b21FB5b3b033BeD50d3BD6bD54c sent 0.049992 ETH in tx 0x629d4fcb0e32d3010275f1ee9cd5a5b024413b45e01e7185d43120588f36e1fe; 0x578f13c23A3de09785210835c554597576131610 sent 0.009992 ETH in tx 0x8931bd135343ecae8f7920c71269d1341a889d91734cd3ba70e0d3e20a164f7a; 0x6e9EfC4d9312fDf2289471424E4cA106C2aA052A sent 0.007389 ETH in tx 0x6135773ee6e2573826529d2e38c1b80412c38f4220898b8d811807313ad43c49; 0x95D6223a18DdF9CD7B90728D62d1a8CEE7a9F914 sent 0.009992 ETH in tx 0x78de41d4b6c872c6b850f957345e0f2387edb494f0cf7e4aa825f553efc67518; 0x9C27f1eC077C4a5320f1664D91F2A794DCc34D4f sent 0.02614 ETH in tx 0x568a774f05ec68825ecae750ff61c7cc95171b3c86ecd1551426bb9adb479a74; 0xA1e275F4e10454967aAadC8Ede30ffd6676eAdb2 sent 0.017809 ETH in tx 0x94459bdbdbacbf37f9c69b1165bf98483e28a8b752b0d2c0616725ca70fd3477; 0xA7b07ad3d5f18ddD41c1929e9094e3A0B7f6417E sent 0.066225 ETH in tx 0xfffca480c08a5aa838de052c2291d100657d65568ecc74a8cac43937d42a6fb4; 0xC09d97369E358B507A3CF5493f875c4ddA2B9362 sent 0.009992 ETH in tx 0x926f83a80f61c24425f7cf66ad06355577d0c2b3e120089b201f6bb7777e66e1; 0xCB62Bf92B4d70567FFd42BE71d23cd2CFF7DE859 sent 0.006328 ETH in tx 0xa8577240328fdf98eafda3aaded33374e8b2557e01fd099cb43cd62c265b9aa2; 0xCbb955a1496c75390A9810ea132c01c97089e41F sent 0.014192 ETH in tx 0x43442c0042b95536a0868ff87ec16ce3b0307a5deb5fe9991b7c5f882f47f85a; 0xDfC8Ccab0663e5Ec9B5d71189bD10D917d8CE706 sent 0.005399 ETH in tx 0xfd70d8e44dd6df0fafaeb253ab094ca72774d135083d29d27c91d6a702af11e8; 0xE60E015213793c71B139fF59D722b6e23A8Fbb53 sent 0.013035 ETH in tx 0x3436159ea8c63cd72bbe19ac3403af70cea2b1acdce95218c11801ea6b61d864; 0xF5218a4FcAdea3a085A8d9ebF40748166F5f35DB sent 0.008893 ETH in tx 0x1000a310b6af9dc943b0c842063cf3d11dd861a627f32e322d5df1fdafd46bdc; 0xFDF042f84D8AE600010FC9c6Ba004e5Dfa92877C sent 0.014463 ETH in tx 0xd5e9c92531ce49722ab9a8d730fbc0c68cafbfe55c9d121b1ed96fc6dcbaf74b; 0xdb8DBBEE3b5e7F4F4d2F15DD452ff91aF4f2EcC4 sent 0.006787 ETH in tx 0xd3f02b26fa6293a69b4c13b1574d5cdecde166e534f851d6040a96691ab808db; 0xe3A626256B25C5E7158C6174721d3ADe83e1D32f sent 0.005054 ETH in tx 0x65b13b8cd7c1065527e7561eb498a73b3ae9e83a16eb5e04cfbc3f30b01adb62; 0xe9f28A477bB22045fBC886e14A85937f051859c5 sent 0.028048 ETH in tx 0x762fb8259f3bad1109308d6d2c51bba463c29f01fd0ae48d5fbe4bb085ac736e; 0xed2796e9673c1c52119d8D107c867239158B480C sent 0.026597 ETH in tx 0xc8c495ed32a622a563e5bf4a6e8f164adee297cdd4228b32b2ef8b0f49fa44a4; 0xfb825D3dA69303fA2cAEAc70F6E24EB8D20616B3 sent 0.0057 ETH in tx 0x2e68a1adc57054c3da3ef9112cb5a194a4368586f4cded959915677eeb63461a; 0x0c92310b97129809c065AD4D1278FaD49bd47223 sent 0.00355 ETH in tx 0xf44df75e0be08a6d37e776d18b5d467b782dff205b1ee9e14215619d4bd0ddf9; 0x19A976bBc844b0Ad71c5F73f2ab83D57b5D8AE96 sent 0.004514 ETH in tx 0x8b511016b2c65b8c84a0b668ef52129a14d7b3c95b8e0dc634174cb8a514a74d; 0x33584dD27aeae167C03F7703CAAAa42EbCa9c741 sent 0.000542 ETH in tx 0xe8f47afddf2d9255700a95f05afcfa1cdce2e8521356a2377f1d8ee5b216fda4; 0x33a97234ed57126Ec727854130bd4be76d3D4148 sent 0.001167 ETH in tx 0x8a3c66fcd12053149099baf76ae2e5d35dfbd3c15cba9e7d48754db18ca41fea; 0x3AD1368C4F75b00246F05148481F22E42716ee38 sent 0.000992 ETH in tx 0x673f44a5b45bf29ce0597ad7f7fc579b3820fc7ca8450d2527b5ab1940415bf5; 0x50188bDE5E2dCDc420b1C45F693c98027C1Df2B1 sent 0.002569 ETH in tx 0x849d04d42b5f2052d07c7826414750096db73093f3d9808fb406bca49131e43f; 0x5ed5104872e427bba238e46aDFbe9dF3F3cC7539 sent 0.001179 ETH in tx 0x2a9437c5ff29f88aeb7163b64c04c3ec090a9204fb0041177dadf124731a6f8c; 0x70D14790F4ED61f333808F66d028655417371025 sent 0.003051 ETH in tx 0x26907f9fd752dfaa890f7e4e18d441b66a531dd9963039ba3f85a76205c88023; 0x7C1Edfd9792D6BbA3C707DDc17f7A2B60e10B2D7 sent 0.000793 ETH in tx 0x70ead5e96c69f1588ba4776cbbbd00cf27c1dcbfe71ec60dc463e49879b1e476; 0x9B3724BF0a133195bF014c7BC48eCB5F30435ddE sent 0.004764 ETH in tx 0x4ced9a21f57b077e09a590a60589d4c8541cb400c8597a280861a42ad76a8b29; 0xFE7e8078266FcD7E2E44C0a326fC10957C94ADB0 sent 0.002495 ETH in tx 0x932715b7df1fa34174d3055e31e16facf3f2f00706d268101a7863cca19ed462; 0xa43d4661e640fD5428A63461981511f41238712c sent 0.003542 ETH in tx 0xf1bd8123006ae0e0e55864c3cc3309861a97eab4ce1f9fe66071a8eda652c811; 0xfD09795d7b99b827f185ccc523901aD5c3fBB908 sent 0.004068 ETH in tx 0x4e9ecc2e5ec21c47b682bb1f7baa68eff1231c3e6d14bef5757a8578568d9d48; 0x3D57de566f738C897482898cB781ed63D36bC763 sent 0.090632 ETH in tx 0xaedba8dffb5d77ee9861266adbe4fc8fc609b59535380696b394c0aa2886df84; 0x43d576fCa6E05890C8da71Dc6dA999C7479f670F sent 0.024743 ETH in tx 0x3516d954ca5cda0ca8e0b0dd498211fe67eac991c052bb16fbe24431db442988; 0x4Dd30AfeD617c47fd14213a4AfC8dCfD33c94DeE sent 0.019325 ETH in tx 0xac5113e68ccde635e2e0921c1d27874b9fa29d71a5bdc38b8008b093e1b643c6; 0x69Fc249f7Da01EBaD2C7789B57C08022d58bdbb1 sent 0.019312 ETH in tx 0x5d5aef73db01705b7d2b75474dca4d0b355cff6c14522986c81b29b15041eb5d; 0x97305f92a7a9e3d2E4EE130811e523455594642B sent 0.019297 ETH in tx 0xf4c19510f4ae583035707ebd21b3ec6df0274f6e8837cd4ec8c238df5bc672ca; 0x0d8279F7170e06a30a3d0fCf17b7461FB6781fB6 sent 0.019212 ETH in tx 0x9c678997f9950c91a58e31a8aad69470b4199335d989d516e4126a354bb20cb5; 0x371F3D2AC32C671A330366330388f80F337E42b3 sent 0.019153 ETH in tx 0x55311f070e2f88d43a1534426396140a918676ea31147e70d43f28212bd1f6de; 0xbA2Fc1D0298F6B542229f8Ace07Ef2E4C3FebFDb sent 0.019066 ETH in tx 0xbac69da256578419f6c22c1292b1490f4a3e362d7856db098e0c0dce89de9e90; 0xae2297dd9E366dEC20EAE1996b0b2cad1Ce98063 sent 0.018999 ETH in tx 0x944b41c42f647645d94048a46ee57a1f63ef2ed72c8679beaa032d19f7154b07; 0x1048d06Bd450631d41665f581CbbD5a7fA61e3e5 sent 0.018925 ETH in tx 0x43bad6d2e31297b2e49d514ad50cc9dc764f59767a830af45ba376c319bee561; 0x5D9bb00dB1d44186854111977744AadC02fe13e5 sent 0.018869 ETH in tx 0x85e730502e1eb1cdc1c41ae9860ec1d0f3a240d124c6b02288f093098c25cff1; 0x11F644BD0b144140C3CE615182c69d6bd4172C10 sent 0.018397 ETH in tx 0x7c2cd3f6940390c3488ceb9d384c8daf3c5acf673abd889d474cb8f6e7bdcc74; 0x41026fb4eb9C4Dd78E1D910f9Df0e5956Be5dC0D sent 0.012227 ETH in tx 0x3bd0fa2f1d7920ff670aaefb91e08c3a866e0772f147fae321b0cbb91886414a; 0xF205Ff50Bee7d23d25367F7E0E215d19272FF7d7 sent 0.011732 ETH in tx 0xd82823747f584958766c7a18f0108e7513ad0a78d9c6eb87aafe6b3b284fb0f7; 0xB368e00b76F2c7C7E8f91DC02Ffd6ad68560FE49 sent 0.011691 ETH in tx 0x190b55362747ab52d3ed66f3f98d5386f4c9446f60951e5976b1573969ca087f; 0x45740649A44085820c666220FF49E703a099aB39 sent 0.011524 ETH in tx 0x7a601d98d092ef14b307add92ede9da66690a6b0e064ab7cf976a7a1bc4bbbc4; 0x66EFB30D5970EB67d4389D83E1407335D31d90f2 sent 0.011375 ETH in tx 0xb4dc0684ebdbe48e0451c28a99cdb1fd1955794dfb472ddb621f5ab65e42243d; 0x68a6295e4E20606506a63e699028Aa79a985Cf53 sent 0.011272 ETH in tx 0x9255955e62c3f1f23a834bd7a47ae028b381cbbcbaa658ff2885dbdaca1232e8; 0x9A5888494C729C59B2f7984f436F8707cc7E4C9b sent 0.011206 ETH in tx 0xba189602d50c1b4124cbd19190e29c8d0a182a41e964c2a359b8dae25e410df6; 0xDd0Efe4909BAcC6804128847DF83deb20f46Cf39 sent 0.011132 ETH in tx 0x474951cbcd98360b48996d5ea81dc06956f82c0bd4c9ee796fb73f796e68d41c; 0xf6f591b488a0E6162dA625916bB1C686f99ba1f4 sent 0.010234 ETH in tx 0x4b5e3cfb1ca10ddef9e06c79b487e03caacbcea59fdb2be03d42d7143e9390cc; 0x3557d4d84d75f1464aF83B0662eBdb996Af936f1 sent 0.008475 ETH in tx 0xd13649dba0f51913814dd606a45abad9b672439067cc967b436e0a12cbfc944e; 0x881bA8F9741BE47aE554844E0cE0359Fdcbc7A0A sent 0.031212 ETH in tx 0xdcfa6c3ab92d5718a393b4dadb3662d7e4fb4814ee03de190fb9968d8402e5b5; 0xD69FCa73097dAE3EefA9441b077728F039ad29eF sent 0.001043 ETH in tx 0x9c904bf326e9a4ccb8607497b673c42d886e8fd71697cda53f408480c01e87cb; 0x2Ce2F02018a3f8623c019bbCCF2C45782268D57d sent 0.001008 ETH in tx 0x2c0a886e40ed538e4b6604070f58e115c8ef77b3ed99cb9ea7356271cca321d5; 0xf82874c00AAb6B8E225DA31F5E6d09c66D7233f4 sent 0.000589 ETH in tx 0xdcbd6d6a917a8aa28e95f3392b02690075b0217d08b35f83b60f209eaa7fe307; 0x5147eC8De543d2d4d36E190cc3F875B6c4B00C74 sent 0.015849 ETH in tx 0x203d979ddc3d50bae6235cbd8ffbab3e85474963a8eaddbdc251ab461864dd91; 0xa241E5865d3cEb3B4241CF1ba071A90B5A4c2845 sent 0.013263 ETH in tx 0xe0476daa200665f9e2a7966140c76971eb6d2469992c765512cc2777126e6f27.