Strange case of Bitcoin loss what happened?

A month ago, I was checking out BIP39 seeds with Copilot and found this seed. I threw it into Electrum and saw 2 transactions in a change address: 172LHmTcW1VESuNtVtPKUdpQNPh2XURjar for 99 BTC. Didn't think much of it until today when I googled the address. Turns out someone lost those 99 BTC! What do you guys think happened here?

That’s wild man. Reading through it, I'm thinking maybe the guy downloaded some sketchy software? Or his device could be infected with a keylogger or something? If it’s a keylogger, they could’ve snatched his seed phrase and signed transactions without him knowing.

Nah, I think you’re overcomplicating it. The owner can pick any address for a paper wallet. Maybe he thought using a change address was safer? If it wasn’t a paper wallet, it might have been a replace-by-fee (RBF) transaction gone wrong. Electrum does use change addresses for that. Could have been a bad client too.

The sender seems confused, right? He claims he sent the coins to a copied address but they got transferred somewhere else immediately. Sounds like a hacker had access to his keys. The whole story feels murky since he’s not clear on his actions.

Yep, I’m with you. Seems like he downloaded compromised software and a hacker used CPFP to grab those funds. His sending wallet stayed fine, so the receiving one must’ve been the problem. The seed from Copilot isn’t that weird, just odd it was used as an example with no source.

What’s the actual seed phrase though? Could it just be some random example from GitHub?

The original poster in that other thread kinda dodged questions when things heated up. But it looks like he used legit Electrum software, no fakes. He mentioned that the receiving address was part of his Electrum wallet. However, it seems there was no RBF involved; the stolen funds came from unconfirmed outputs in the same block.