I have generated most of my wallets through brainwallet.org.But the address that got hacked was the only that I used to create a transaction via brainwallet.I don't remember my passphrase since I was just smashing my keyboard writing random characters for about 10-15 seconds it must have been at least 50(though I think it was more than 100) random nonsense characters.I then just copy the addresses and private keys to a notepad and forget the passphrase forever.I am almost sure it has to do nothing with the passphrase.
they could be scraping or using weak rng...and maybe some fancy elliptic curve calculation where they can determine your curve points once the transaction is made.
i think serious cold storage efforts should involve rolling physical dice.
A million opinions on what the best way is...and every time something goes wrong a million explanations regarding what could have gone wrong.
This inspires trust in bitcoin only in the most naiive.