I thought the wallets couldn't be hacked.

He has a 30% success rate. That's pretty high.
I think he uses mostly social engineering techniques, like you give him some ideas of the passwords you already have and what you thought it could be and he tries different variations. Even if he doesn't get in the wallet 30% of the time, does it explain why 70% of the time customer's other bank accounts and stuff is all gone? Very suspicious???
https://spendabit.co/go?q=steel+walletBlockchain put people who are looking to recover passwords on to him. Are they not legitimate? If he's stealing bank account details this would make Blocchain an accessory and a cohort.
I don't believe the article mentions '70% of the time customer's other bank accounts and stuff is all gone?'