I thought the wallets couldn't be hacked.

He has a 30% success rate. That's pretty high.
I think he uses mostly social engineering techniques, like you give him some ideas of the passwords you already have and what you thought it could be and he tries different variations. Even if he doesn't get in the wallet 30% of the time, does it explain why 70% of the time customer's other bank accounts and stuff is all gone? Very suspicious???
https://spendabit.co/go?q=steel+wallet