Relayed by ip: Blockchain.info - does this not mean that the hacker's IP has been relayed by a provider known to Blockchain.info?
"Relayed by ip" is the ip of the node that relayed the transaction to blockchain.info. It is not the originating node. However, in this case since the relaying node is blockchain.info, it must have originated there, and that means that the thief probably logged into your account to steal the bitcoins.
Wait, but why the 'hacker' stole only 4 bitcoin and not 'all the bitcoin', because I've checked the *transaction and a change/rest of 0.02883142
BTC returned to the input address (1JEBDTC8opFTiUmM19J1NY8D8h57rF7bgE).
*
https://blockchain.info/it/tx/4582dce49c12800cf78fdadec7b700c329e2e28629d3de770f8f2a3af60dae1fthat hacker seems to be generous person who let remain little into the wallet but mostly that thread look like newbie troll,
it doesn't make any sense to me to believe on this story.
I also don't believe in this story, something is not gone in the right way. However the 'hacker' moved the bitcoin:
-
https://blockchain.info/it/tx/bc042bf7216f358a421db96c4df7ea40b5d5ce56a08835d5346352c319e696e8I have found out that there was an unauthorised login to my Gmail from a British Telecom public internet access - either a proxy or a public wifi at the time of the incident, from a Windows computer. My Gmail contains the credentials in a non-obvious form.
You should contact the blockchain.info support, but I think it's really gone (because they will not reimburse your loss).