Tell HN: Crypto Wallets Trust Wallet and Ledger appear to be compromised

I'm really devastated. My nephew just called me and told me all his cryptocurrency is gone -- valued over $40,000. He has spent years earning it and resisting pulling it out, hoping he could eventually use it to pay for his college education.

Here are the facts:

- He has a Ledger Nano S wallet.

- That wallet had 4.77 LTC, 4.48 ETH, and 0.73 BTC.

- The Ledger generated a passphrase containing 24 words. He didn't add the 25th optional word.

- He recorded that passphrase on a piece of paper and hid it.

- No one had or has access to that paper. This is an absolute certainty.

- That passphrase (those words) were NEVER entered anywhere.

- On February 24th at 5:45 AM Eastern Time, the BTC was stolen.

- On the same day, at 6:46 AM and 6:48 AM, the ETH and LTC, respectively, were stolen.

- He also has a Trust Wallet.

- He had $1500 worth of NPXS and $1000 worth of TRX in that wallet.

- On February 24th at 6:48 AM and 6:55 AM both of those were stolen.

- The passphrase for the Trust Wallet is saved as a screenshot on his iPhone.

- His iPhone has not left his possession.

- His iPhone has a 6-digit passcode.

I have the recipient addresses. It looks like the thief has stolen crypto from others as well.

Note: Both wallets were hacked on the same day at around the same time. Both had separate passphrases.

Can someone please shed some light on what can be done, if anything? How were both wallets compromised at the same time?! If nothing can be done to retrieve the crytpo, what can be done to prevent this from happening in the future.

Edited to add:

Here's the BTC transaction: https://www.blockchain.com/btc/tx/4b05e788a4338d330f3d8a19c87c520e78db28c356c1e6bc1fd4d7e186c91892

I want to make it clear that the Ledger passphrase, on paper, and hidden, was not ever accessed. And, even if it was, which it wasn't, his Trust Wallet on his iPhone was also compromised.

How can someone guess both passphrases, from separate wallets, in separate locations with different words? It's literally impossible.

Whatever technology is used to generate the passphrases in each of those wallets must be compromised.

Nothing else can explain it.

I cannot stress this enough. The seed words on paper were never exposed.

iCloud could explain his Trust Wallet, but not his Ledger wallet (with the seed words on paper, hidden and literally not seeing the light of day for years).

> - The passphrase for the Trust Wallet is saved as a screenshot on his iPhone.

Could the photos have been uploaded to iCloud and compromised from there? Or accessed from another device?

That's partly why I'm posting this here. There must be something else going on. The paper with the seed words WAS NOT accessed.