Do we know how the attacker used this knowledge to access wallets? I’m not super familiar with crypto or wallets but that’s the last piece I’m missing
2. For each seed, generate a few addresses using BIP-32.
3. Use a blockchain explorer API to check if those addresses have been used.
4. For each address that contains unspent coins, generate the corresponding private key (again using BIP-32) then create a transaction sending the coins to the attacker.