from lopp:

I had someone contact me about this earlier today and the one thing they noted is that their full wallet balance was not swept; it was only a handful of UTXOs that were swept. I told them I suspected that their seed was not compromised, but rather something they did had compromised individual private keys.