Wallet sweeper 0xc3D93182…: 38 Ethereum wallets emptied, 26 Oct 2026
38 Ethereum wallets sent their whole ETH balance to one new address, 0xc3D9318237CcF8c02D62B1F47e2c5044601D665d, in automated waves on 26 Oct 2026 — 0.1624 ETH in total. The pattern points to leaked private keys or seed phrases. Every swept wallet and sweep transaction is listed below.
Between 26 Oct 10:47 UTC and 26 Oct 10:47 UTC, 38 Ethereum wallets each sent their entire ETH balance to the same freshly created address, 0xc3D9318237CcF8c02D62B1F47e2c5044601D665d. Taken together they lost 0.1624 ETH. 7 of them had not been touched for more than a year, the oldest since 2023. 38 were left with exactly 0 ETH, the same remainder to the wei, which is what an automated sweeper script leaves behind after paying gas. The wallets were funded from unrelated sources and show no sign of one owner moving his own money. This is the signature of private keys or seed phrases that have leaked, and of a script that empties every wallet it holds a key for as soon as it is run.
It got 0.0117 ETH back from swap contracts (MetaMask, contract, deposit → hub 0x2b43e084…, deposit → hub 0x5111a967…, deposit → hub 0x5a749b9f…, deposit → hub 0x69460570…, deposit → hub 0x6cd3dfef…, deposit → hub 0x77e7c5cb…, deposit → hub 0x7d7e81fd…, deposit → hub 0x8652767d…, deposit → hub 0x92d47b6e…, deposit → hub 0x99761706…, deposit → hub 0xa13dcee9…, deposit → hub 0xa7b5ce53…, deposit → hub 0xb01bda16…, deposit → hub 0xb2d0340e…, deposit → hub 0xcfc0f98f…, deposit → hub 0xff93f345…): that is the collector selling what it took, not new money.
Where the money went: 0.2387 ETH to 0x337685fdaB40D39bd02028545a4FfA7D287cC3E2 (Mayan Finance, 26 Oct 17:11 UTC, tx 0xc4d389f362e42ff357dd4c815fa5e62c9a607565d7ca872229cc1bc2d8e00bcd).
PublicAML has labelled 0xc3D9318237CcF8c02D62B1F47e2c5044601D665d as a hack collector, so any wallet or exchange that screens it with PublicAML sees a critical risk score, and the exchange deposit addresses that received the proceeds carry a stolen-funds label. Exchange hot wallets are not labelled.
If your address is in the list below, assume its private key or seed phrase is known to someone else. Do not send anything more to it. Move any remaining tokens and NFTs to a new wallet created with a new seed phrase, from a clean device. Keep the sweep transaction hash: the exchange that received the funds and the police will ask for it.
Sweep transactions, one per wallet: 0x1D684e3B26Bcbfad10CEC673B718d00Ef469345a sent 0.003675 ETH in tx 0xb6cb17d77f42ae5fee2e07e5cd41e042a78702dd4723ace2bd806858f46dd0ed; 0x1afecf82e82f4Ef7bf7E058CBe0d02743d269350 sent 0.000468 ETH in tx 0x0e9bb0b9aedd97a5c5b4b7406d62278e1c1d610cc027fe733d0544aba3e6ee0b; 0x4A1032A2c7b1CC26d653b35E854c0093759d6682 sent 0.00164 ETH in tx 0x3e7fc53ca9d0f2315a706265fa7d77c4649c868982f94977aa9944562bc7f5ad; 0x5CCe53d05e9143aee8723776fd27f669e6F1Fb59 sent 0.000337 ETH in tx 0x5f8346462f80231fa9ff4351ba6a29a80b5c1d090046f1ac414f1cfc29282449; 0x600B4FF577DB709d460f20949468Df79Ab595d24 sent 0.004294 ETH in tx 0xd2e5adbb77c119d361e5d98dc17e19ed6b0b342dc1995bf87b69d59d792b69ff; 0xACa285c94AEc87Caa8dF620275Da03F4F9EE8937 sent 0.000885 ETH in tx 0xf743552bb1a4a4ec35456426ef40fb2d535129a8d5af4f22b651fd667e3a5313; 0xb7CCe51bfC95e2B94DAa1E8a6200CB00cF387465 sent 0.000627 ETH in tx 0xbd577e3e70d1fd308e0140a0644dbb0a91a92dfa50a902f1be2d51180546bc6d; 0x3e5Aee94103bB95659Acb5Ee6D378B69c931f09E sent 0.00044 ETH in tx 0xe493091e01a015cb4033949e29ad5c8b5f000a2bfac08b00b2e68af6a1f80549; 0x5BebeaF24e67F2f1b2C7Db3D79B489b9E4b165eC sent 0.000385 ETH in tx 0x65c3e54b36bdf98fa3d5bd7980f0c0e61caed622fb1261f8d7f1527b6d5cdb48; 0xFa53689f9a44dDa798fCF19aBbD46aaa3c2e5380 sent 0.005498 ETH in tx 0xb2ebc9dc9b9a5e67e1f13db4e43dce55992ebfbd7cd4fd2166a8c5500f545bdf; 0xfdefCbdD38eD0C21E7A2237619e19a294DDB140b sent 0.000493 ETH in tx 0xf39aa9d826f5fe30d040c9f0c39eed3a0b4b5f98b663f7f5cc0374eb0938a7e0; 0x1737613abd227a1ac65Aa2746c86d32FfD1389da sent 0.006521 ETH in tx 0x6d53b8c056e473f4c602c9d1afb1a33d87ee5a93657dc54d67d20d3a5aed3253; 0x41d1904f2e4E45843b295b1dd49E34dFB65eB3Aa sent 0.001753 ETH in tx 0xb269f88d3fa2407600930d00b054256e5df866d24c6b71740ba8c4e93ad444c0; 0x6D2e7dF12F0A62b8Ff5C30071250a4ef82C35d4a sent 0.000329 ETH in tx 0x9383193553e2c4e9bbefc73730f38177d54d70f69489cea8b0eadd5b70bdd6d1; 0x8A345A59D24040042baa00753226809900bFF37B sent 0.001731 ETH in tx 0xa5f8aa1dce1c715970429afbfe56f52b271181e1f3a26a913d8978199eeeceff; 0x37F5491f616D4c7bA407AC64224aB949BDa2b318 sent 0.002166 ETH in tx 0xd9e57b2bf01fbd7ef7c29cd4b60f0f425668a217592c9f191f7d3b622fc9d417; 0x46D16df635e1Abd69caB9A8CBF04487a60B39c86 sent 0.000472 ETH in tx 0x2507162b8b78dbca203f3e09d3e7bf1a679c6c4e0d7d1c31d3a3925ccd1c714b; 0x63Bc0752b041013A01fce9925C5e00cCCF405529 sent 0.000809 ETH in tx 0xb580bc967e86916462aa4e79a88166266e63a2203adcd502165eb5f10c15b58c; 0x672259AA2c62eF25fC66Da827D8968037D2bDFFB sent 0.002671 ETH in tx 0xa214e3052375eb11c6b78352ec263ebbb70a7c491a6f05b504f6eb5f63db4286; 0x7FED816b34b21A0d4Ac269E3bD2B2C4a0b2229ed sent 0.001614 ETH in tx 0xd46b8aa34a4ac7cda42fd5cfd9839d16fbd162f3235f496d19a63c851e06c771; 0x91Af69147Aa40D2E962F08ed701eaC38995888A3 sent 0.000323 ETH in tx 0x08adf9f74aff8557b5d970f3b988dd07f21133d4103c7562da6c7b11c53800d6; 0xA68ff91cF8bbe9032972188325244022eD93ffAC sent 0.003341 ETH in tx 0x053b612d3ba3b2e93c133ddeec8115cec282ea1f96a4d566ecb63aa467d3c741; 0xAebcb9c5D2E71DE2B267D163818BeAcD5fACcF2B sent 0.000957 ETH in tx 0x8120f9ed4d277ac5379511d98f8a4e83c7559c9bd0e54df4683014eddde277f5; 0xc2E4b1e294b3f5ea7Be5d0376be3a66f23ABE633 sent 0.000457 ETH in tx 0x26699777f6228d882a111e70c81ab1f25081e6a9d432bf6db46e52a046240ca5; 0xd2a87C9b9475e869542cdF70219aac7888B8f12F sent 0.000661 ETH in tx 0xd2b085c4447b0db61f7d847e9794d24d0c2646dff75b7e522fcca71511a255e3; 0xf75Db8975068ab22f1aF24ceC0449346AD552301 sent 0.000606 ETH in tx 0xe6d50b92eda0ee3323c880aa64a1ab7179ba166d1a8b0856d5ae052471072ca6; 0x2d394F11BC01B2Ff4e3473209d2fC52F4CF21FA3 sent 0.000481 ETH in tx 0x975739b53acb13870443945259c19615eb197793bf358f94fc372cbde6c311b8; 0x43816A5365Cd900f181CAAdb8673cE016d70E31f sent 0.001292 ETH in tx 0x1e4fc75de410536a8c7f53cb8c3cfcdb6331b4de6d7ecd5017341716bf86cc4b; 0x8e8e275D88a4A32a4c65E323048b89450Be6CE59 sent 0.000976 ETH in tx 0x0ee36b5aa30268993aeda3c75bc09a0b221f2b227a21a22fe50ad2e5513d9544; 0x968b5284b2A89aB64ae9af004572C0e4794D33C6 sent 0.001019 ETH in tx 0x61dba62af6ecf2867df3a45f9476366ca626e58bcf678eeb794a8b042de73044; 0x9C5741864a408f80ee37De6c698d33E24D139fCd sent 0.000444 ETH in tx 0x7a9dd1bcd25675e8007db028dfad65504aa4c4a32d1fb20d7cabe5e6fe448cea; 0x9F9337163886c1e87D626F496135E3b1317c8d23 sent 0.002004 ETH in tx 0x3402fa1cb1d127ea797be1c90d6b1a3485f6f23abed2f2ae9b41eb02eef6d2c5; 0xB360A4406d28300Ffc4e487c413A69c4D1125eaC sent 0.000454 ETH in tx 0x06d27168c07d074fd445fa7f815b17a7f72d012b28f0b8d03cd8231a13c2b9b3; 0xB9322606d328EEac7275936394a4b49038F3805F sent 0.001678 ETH in tx 0xbdb9dda0f5c606230d5195b1269d9d45d7784bced24ed42c555d6c9db489c607; 0xc131Dab118D11455255B8e3beB2Ac10D3e945217 sent 0.059991 ETH in tx 0x8fe7eefcca7484325eff53a45a92dcb71c4435111331b728b090a8478b0957de; 0xe5A929FBcaF8cC5285C6D3e18d06Da3f4e03386B sent 0.049955 ETH in tx 0x519c6f5591e5e03cf7c1f86102c87451d873f22b2a51fadd213715d244178d3a; 0xe77cD0750681a82c21beD4Ce29e0e0b5A8c480f1 sent 0.00058 ETH in tx 0x2ff8bc9ac90fc31f252f5559f72a16f2189afd584291a04a9e859d345fe937ea; 0xe8b790611EBbD28f76a2693f81EaC8e90b02357a sent 0.0004 ETH in tx 0x3a38e7ebee9aadb62412d8f479f4cd87b523c39c22d62b6a80b2abdf2e576ff3.
Addresses in this incident
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.
