Yes, a smart contract, if ever the address is a contract address, with forwarder function generate by the hacker, you can see it when you access your eth address to the etherscan Code tab  - https://etherscan.io/address/your_address_here#code.
If not, then the hacker just sent the ether manually.