I was the person who observed the same account stealing ETH here ETH stolen on Ropsten.
My original command to start geth was geth --testnet --syncmode "light" --rpc --rpcapi db,eth,net,web3,personal,admin --cache=1024 --rpcport 8545 --rpcaddr 0.0.0.0 --rpccorsdomain "*"
This was of course the most insecure since --rpcaddr 0.0.0.0 allows anyone to connect to my geth instance and --rpccorsdomain "*" allows anyone to run cross site scripts on my geth instance.
I changed it to geth --testnet --syncmode "light" --rpc --rpcapi db,eth,net,web3,personal,admin --cache=1024 --rpcport 8545 --rpcaddr 0.0.0.0 --rpccorsdomain "" and waited for 3 hours before my ETH was stolen again.
Next I secured my geth instance with geth --testnet --syncmode "light" --rpc --rpcapi db,eth,net,web3,personal,admin --cache=1024 --rpcport 8545 --rpcaddr 127.0.0.1 --rpccorsdomain "".
My ETH was stolen YET AGAIN. But this time I observed 2 things:
- The stealing wasn't in bulk. It took 0.0000728 Ether several times.
- I checked my geth instance, there was no signs that the transfer was done through my geth node.
My conclusion was that the hacker now has the password to my account. He unlocked my account on his own geth instance and took his time to take my ETH.
My answer at this point will be the following:
- --rpcaddr 127.0.0.1
- Turn off rpccorsdomain
A Geth node should always be accessed locally.