this is was the transaction where he drained the funds on eth mainnet https://etherscan.io/tx/0x18e0b6674a4b607ebb53d269296355dbbe9f825f37dd1df3847e5d77e79cf9ff hacker wallet address: 0x7387b3f6b8ac29c8fe0409c2e702bcc1a8c625fd later he transferred the funds to 0x4a77c0d6d0d4599ad5290dc4c35e522099ff670b wallet with transaction id https://etherscan.io/tx/0x7984bee3c2821ffdb84783324d58d637a8e75314c46a023d6ea9932282ba8c9b than with these 3 transactions he transferred again funds to different wallets Transactions: https://etherscan.io/tx/0xd46acfb778441e8bd29851fafed979596435200617b463f37b1241637b598359 https://etherscan.io/tx/0xb0aaad62748744c4eef5b3dee59e549f9edff7e5beefe998dd6d28a5a997a3c0 https://etherscan.io/tx/0x5b6bb1e34544d59342e283036a9cd9e6b22549cdddb95cb283be0f20056e13e8 final wallet addresses where currently funds are: 0x60327affcbcfa9b5488ac9b89a296e03c12c2445 0x6361a3ff59a71a4b85c2ec8b1a87c4e23c567eab 0x8e133cbac54740f9c908d53bbc01b510fe180c7e

Phishing Website, Malicious behavior: SetApprovalForAll