This isn't phishing🤦‍♀️ These private keys were previously compromised by malware. They all have their balances swept on other chains to known sweeper bots associated with MaaS / infostealer logs e.g. Raccoon, Vidar, etc. Basically someone went thru millions of already-compromised keys, identified the ones that had Hyperliquid shit, and is sweeping those balances. The keys were seen in logs (aka compromised) as early as Fall 2023 and as recently as Mar 2025. Most of the ones with any remaining balances are found in the more recent logs (e.g. Jan 2025) but this says more about which addresses still have a balance than it does about when the key was first compromised. Lesson: Don't install malware, kids.