Would that password have also worked on his PGP Keybase account as well?
Neh, mah PGP key had a different password.
- Why wouldn't the "hacker" just send the btc away individually as he got control of each of them over time?
Maybe he just got the privkey of mah(not the password) wallet & he did import the privkey in his wallet & then used all his addresses as the input address.