As a non-custodial service, we don't store seed phrases but with the help of this information, we are able to check the history of transactions and see how many of them have been performed through Blender Wallet.
Fraudulent transactions have been identified according to several parameters, such as performing transactions bypassing Blender Wallet interface, turned off RBF, a single transaction sent from different wallets of our users as well as the time frame of the incident. Users witnessed the hack in real time and could cancel the transaction. But because of RBF being turned off, the button was inactive. Evidently, hackers didn't get access to Blender Wallet's functional. We can't say for sure whether they took it into consideration, but if the RBF feature was on, users could cancel a transaction with a single click.