Address No 2 seems using smart contract as it can transfer automatically when any ether amount received by the wallet stolen to directly transfer to the thief wallet as the destination.