Usually what happens is that there are bots that are constantly searching for low entropy seeds. As soon as any sats land in one of those seeds they RBF into a wallet controlled by the hacker. Since there are likely many bots doing this, sometimes they RBF each other to get whatever they can.

From this example they paid about 1 bitcoin but they still managed to steal 2.

What I don't understand about this transaction is that the previous transaction was included in the same block. I would have thought the previous TX would need at least 1 conf for this to happen. Looks like it didn't.

Aslo, I wonder if ViaBTC will give that fee back to the owner.