I have generated most of my wallets through brainwallet.org.But the address that got hacked was the only that I used to create a transaction via brainwallet.I don't remember my passphrase since I was just smashing my keyboard writing random characters for about 10-15 seconds it must have been at least 50(though I think it was more than 100) random nonsense characters.I then just copy the addresses and private keys to a notepad and forget the passphrase forever.I am almost sure it has to do nothing with the passphrase.
they could be scraping or using weak rng...and maybe some fancy elliptic curve calculation where they can determine your curve points once the transaction is made.
i think serious cold storage efforts should involve rolling physical dice.