"appear compromised" should be reserved to when multiple unrelated instances occur with no direct relation.
While you describe plenty of recent facts, from the "he has spent years earning it" I take the wallets were setup years ago and honestly, I would not trust even myself on operational security of a single device/passphrase that I may regularly use.
Are you really sure that a given iphone has never "left his possession"? Was it locked in a safe the entire time?
Comments
"appear compromised" should be reserved to when multiple unrelated instances occur with no direct relation.
While you describe plenty of recent facts, from the "he has spent years earning it" I take the wallets were setup years ago and honestly, I would not trust even myself on operational security of a single device/passphrase that I may regularly use.
Are you really sure that a given iphone has never "left his possession"? Was it locked in a safe the entire time?
It's a wallet on his phone and a hardware wallet. Both were wiped clean at about the same time.
But what about his hardware wallet backup, which was on paper?