It was an exploit related to @Alby hub. Their installation page requires 0 authentication and gives access to the entire node. They call it good UI.

Ah damit never keep more then a few $100 worth of bitcoin in such wallets

That sucks. I don't use Alby. But know a few who do. Got more details?