I don’t think this has to do with hacking, as in - if it were possible to hack a sc wallet, you could do that to all wallets, so why target a wallet with relatively low amount.

Most likely either that the person was sloppy while storing his keys, or entered them in a scammy site.

Still sucks and unfair! But nothing points towards self custody being hackable.

!DUO