Wallet sweeper 0x1c3A69b4…: 8 Ethereum wallets emptied, 24 Oct 2026
8 Ethereum wallets sent their whole ETH balance to one new address, 0x1c3A69b42e84168528D434e4651aAEC3F497e6EB, in automated waves on 24 Oct 2026 — 0.5836 ETH in total. The pattern points to leaked private keys or seed phrases. Every swept wallet and sweep transaction is listed below.
Between 24 Oct 20:02 UTC and 24 Oct 20:16 UTC, 8 Ethereum wallets each sent their entire ETH balance to the same freshly created address, 0x1c3A69b42e84168528D434e4651aAEC3F497e6EB. Taken together they lost 0.5836 ETH. 8 of them had not been touched for more than a year, the oldest since 2020. 8 were left with exactly 0 ETH, the same remainder to the wei, which is what an automated sweeper script leaves behind after paying gas. The wallets were funded from unrelated sources and show no sign of one owner moving his own money. This is the signature of private keys or seed phrases that have leaked, and of a script that empties every wallet it holds a key for as soon as it is run.
Where the money went: 0.6546 ETH to 0xb5d85CBf7cB3EE0D56b3bB207D5Fc4B82f43F511 (Coinbase, 24 Oct 22:01 UTC, tx 0xbacd8cb4b335b842b5613ed2a34b35d1ac1c9b7a5dff7d627dd52249f0e399e4).
PublicAML has labelled 0x1c3A69b42e84168528D434e4651aAEC3F497e6EB as a hack collector, so any wallet or exchange that screens it with PublicAML sees a critical risk score, and the exchange deposit addresses that received the proceeds carry a stolen-funds label. Exchange hot wallets are not labelled.
If your address is in the list below, assume its private key or seed phrase is known to someone else. Do not send anything more to it. Move any remaining tokens and NFTs to a new wallet created with a new seed phrase, from a clean device. Keep the sweep transaction hash: the exchange that received the funds and the police will ask for it.
Sweep transactions, one per wallet: 0x7FCeD8D61Cf5e59b41Fc142D73B86246d4C3eCb9 sent 0.499979 ETH in tx 0x1f2a81fc1e36e79f8d9f4fb87d368cb6a56db77f1eac9d575c3ad21171542762; 0x26a6c7916a84E27D1417D6E5CdbE6cb29C721271 sent 0.006289 ETH in tx 0xf212ca11375af12302d0a24d4c28acb1d78a041aac2077a4a2f80e2f50b4801f; 0x52515c3fA8Fa0009a860627CEd158cCE6FcA20F6 sent 0.005489 ETH in tx 0x3aa85ee6d6dc14aff78df7a10b22d8743b6ed998a82bda71a1d94edebc4df866; 0x9056e2f65Bd329aD36A1825bfF436bBd60530F86 sent 0.039151 ETH in tx 0xa49af4aceeca3060ab3dbfd707e90b83b1fdc66b1afc8798da91f9a1e835779e; 0x9993acBD3212ffCB75d8c3e09aa0A92D19B9E7B2 sent 0.001371 ETH in tx 0x6ad64f48188a3da6b67333e2818f129d9bdf5ccf905fb40264e3dd17ffac962b; 0xCeBD0A063E6d048677C8f0FeE4aAaaa58667F4e0 sent 0.012752 ETH in tx 0x9e59f698ba26dca21c9081b7a7b345f5992852914cb1672feb5a102c172d37e5; 0xcCd035a4E8fdA69b5607eA1f6c2686083CcF91A4 sent 0.017989 ETH in tx 0xaa08bf07ed6fed8638c6cf61de1f7cccee060956762f5dac9f64c2c0236aea10; 0xf90DA72C1fcB8129875B59A011f604B019AdeEF3 sent 0.000604 ETH in tx 0x46d9957924e0d421879086849091e865174a76bd49bdd45ce110a71b6163b70d.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0x1c3A69b42e84168528D434e4651aAEC3F497e6EB | ETH | mentioned in coverage | Check live |
| 0x7FCeD8D61Cf5e59b41Fc142D73B86246d4C3eCb9 | ETH | mentioned in coverage | Check live |
| 0x26a6c7916a84E27D1417D6E5CdbE6cb29C721271 | ETH | mentioned in coverage | Check live |
| 0x52515c3fA8Fa0009a860627CEd158cCE6FcA20F6 | ETH | mentioned in coverage | Check live |
| 0x9056e2f65Bd329aD36A1825bfF436bBd60530F86 | ETH | mentioned in coverage | Check live |
| 0x9993acBD3212ffCB75d8c3e09aa0A92D19B9E7B2 | ETH | mentioned in coverage | Check live |
| 0xCeBD0A063E6d048677C8f0FeE4aAaaa58667F4e0 | ETH | mentioned in coverage | Check live |
| 0xcCd035a4E8fdA69b5607eA1f6c2686083CcF91A4 | ETH | mentioned in coverage | Check live |
| 0xf90DA72C1fcB8129875B59A011f604B019AdeEF3 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.
