recently someone is selling fake bitcoin wallet.dat file containing 3050 BTC (
https://www.blockchain.com/en/btc/address/1Lg5pJRaWKw6n2J4CBjoEJY5ZdLwBu21U2)
that wallet is my friend wallet and he immediately moved all bitcoin to different address.
scammer send small amount of btc in all such cold wallet and check if wallet is active or not,
if wallet is inactive then they create fake wallet.dat file and fool other
They can't actually touch the BTC so moving it was unnecessary. There's a little more explanation in this thread: