@nomachine

could you please give us a step by step tutorial to run a script to try to drain the bitcoin?

Since it's in 4 hours and since he's doing it live, I would probably try to manually extract the public key and manually try to re send the transaction. But since there are million of transaction how to catch the targeted address?