[gruez]

>but it's quite strange that both of them would be compromised at the same time. It's also strange that someone in possession of a compromise for one of these wallets would use it for merely $40,000.

Which is why I think this is an inside job (ie. someone close to him, or as some suggested, himself). If this was a remote hacker, it would require quite a bit of effort: scouting him out as his target, hacking his computer/devices/accounts, discovering his holdings (as opposed to just grabbing the trust wallet and running), preparing the malware/ledger exploit. While it all might be worth it for $40k, there are probably better targets than some kid with only $40k in crypto. It's far more likely that someone he knows or is close to him got access to his icloud account (through his unlocked phone/computer), and found his stash where he stored his ledger recovery phrase.

[randomopining]

But only the 2nd wallet had the phrase on iCloud right?

So if the passphrase for the btc one was only on physical paper...

The passphrase is used for recovery if you don’t have the PK right?

Either the device was hacked or somebody got the physical written passphrase, it sounds like.

[gruez]

>The passphrase is used for recovery if you don’t have the PK right?

yeah, it's in case you lose your hardware wallet or it breaks

>Either the device was hacked or somebody got the physical written passphrase, it sounds like.

Exactly, but the latter is much more plausible because it doesn't involve elite level hacking.