I see lots of inaccurate info or assumptions about what transactions/data that the OP signed in this thread
Based on the native ether send in the tx hash OP posted, this is a private-key level compromise. Since the OP didn’t mention signing anything and said multiple wallets were emptied it’s most likely the seed phrase was exposed in some way. Could be related to the LastPass breach or maybe it was pushed to github accidentally.
I see lots of inaccurate info or assumptions about what transactions/data that the OP signed in this thread
Based on the native ether send in the tx hash OP posted, this is a private-key level compromise. Since the OP didn’t mention signing anything and said multiple wallets were emptied it’s most likely the seed phrase was exposed in some way. Could be related to the LastPass breach or maybe it was pushed to github accidentally.