@Lucius,

I think the explanation you give looks legit. That was the question i had because as you can see in the transaction summary two transactions were done exactly at the same time. One is legit to Bitrefill for some vouchers and the other transaction is the hack. The thing that upsets me te most is the fact that the Trezor can be so easily hacked! There should be more protection since i have lost all confidence in using a hardware wallet.

But i also noted that the coins weren't moved.....It would be great if there is somebody/company that can track this wallet ID.....I might need to check the change path protection issue. If you can provide me with more help i would appreciate it!