pull down to refresh

This is super weird. He says he only deposited to the wallet and never withdrew. If that's true, looks like he leaked his seed phrase. Doesn't seem like a Coldcard issue. Let's hold off for more info.

That would be my initial guess, but it seems the receiving address got coins from a large number of addresses in a short time frame, at least according to a reddit comment. Could be a cold card issue, or at least something other than straight user error. I'd agree on needing more info.