Guys! I will explain to you what's happening with this address 0x3463934897d356B8659cBDFE15209e3bC3229105. If you guys are wondering how he manages to steal tokens from wallet, it's from those bounty spreadsheets. There are some people who mistakenly enters their private key instead of their Public key. This guy uses a script and runs it into 4 wallets the guy owns.
Here are the 4 wallets:
0x3463934897d356B8659cBDFE15209e3bC3229105 -> This wallet is where all the ERC20 TOKENS GOES INTO. So whenever Eth is sent to the victims wallet, it automatically process the transfer consuming all the Eth for gas.
0x7f94174d560e4d86d4f3b2213a221f2c33b14015 -> This is the 2nd wallet the guy has. Whenever there are still a few Eth left after the token transfer, the script of this wallet runs to transfer the remaining eths.
0x852E3838beBff4f6B1FebBEc91135DC10C2D19E2 -> This is the 3rd wallet. Whenever a new token is received on the victim's wallet, this address automatically sends Ethereum for gas to the victims wallet to transfer the newly received tokens to the 1st wallet, 0x3463934897d356B8659cBDFE15209e3bC3229105.
0xE639Bd0f74BC3859F86dD01885b60915d780e686 -> This is the fourth wallet. This wallet acts the same with the guy's 2nd wallet. It will steal any Eths left or being sent to the victims address when the script on transferring tokens is not working.
I have been observing this guy with all the wallets that got compromised. I feel jealous because the guy is f*cking earning free money and have been hoping his computer crashes or he dies. Im not even sure if he's a he or a she. LoL
He had also an old wallet with the address 0xa3174E15428731561315Cb603c906E06Cc9B85b1 before which just steals any eths transferred to the victims wallet. I think he replaced this with the wallet 0x7f94174d560e4d86d4f3b2213a221f2c33b14015.
Judging by the activity of the eth wallet on your profile, you seem to be doing the same with 0xeB92f0f58b218ad22a22741D5aa5bb7250E70045, or maybe you are the 0x3463934897d356B8659cBDFE15209e3bC3229105 guy, how else would you know precisely what the operation is?
0xeB92f0f58b218ad22a22741D5aa5bb7250E70045 address seems to have stopped activity but has activity like you described above. Guys I think this is the guy returning to the place of the crime.