Could the multi sig wallet be hacked without hacking the 3 wallets used to sign ?
No if the script is correctly generated and each cosigner Electrum wallet only contains one master extended private key and two master extended public keys.
But your MultiSig only requires two signatures based from that address' witness script so the hacker only needed two:
OP_PUSHNUM_2
OP_PUSHBYTES_33 0228c5b5d4c9048666a8ea5b61485d7c50427b72f06fe2c5e22df60eae9aa8fa9f
OP_PUSHBYTES_33 02a971a0e958145dd98af62844144c7a306863d00ff85a9c99b0e4c355a522d551
OP_PUSHBYTES_33 0332a0c7ed49f5ead4a21d7736ce9b05f6f80b6f87e902281655dc38521d2233a2
OP_PUSHNUM_3
OP_CHECKMULTISIG
(
there seem to be nothing wrong with the script so it's hacked through the private keys)
But in February 12, my computer got hacked. And Bitcoin of some of my wallets got moved somewhere
-snip-
The 3 wallets that were signatories to that multi sig was not hacked. As in no crypto were lost on those wallets
Is one of the MultiSig wallet cosigner in that hacked computer?
How many master private keys/seed that the MultiSig wallet contains (
remember when you created it), excluding the Ledger wallet cosigner?
If you can't remember, you can see by removing the wallet's password and by opening the wallet file 'as text', check if it has two master private keys or seeds under "
x1", "
x2" and "
x3".