All my metamask wallets leaked somehow

### What is this about?

So two days ago I woke up found many of my wallets empty someone used them some how.

Investigating I realized these were all meta-mask wallets.

1. It can't be a seed phrase leak because most these wallets were imported into meta-mask with private key and belong to multiple different seeds, other addresses from those seeds that I did not import in metamask were not touched.

2. The problem seems to have happened two days prior to that because some addresses that I imported 1 day before the issue remained untouched.

I never connect to sketchy websites, metamask is set to be only active when clicked.

I managed to narrow the possibilities to a nextJS project sent to me by a friend, it looked normal and being sent by a friend I admit I did not suspect knowing there are similar scams running on Upwork and fiver targeting Devs with really convincing websites source codes etc....

This is not to try and blame metamask but for me to see what exactly happen , I still have the suspected source code and I wanted to investigate further to see what they did but I do not know how metamask work

since the keys never leave the browser I assume they are saved in the storage maybe indexeddb, theorically no one can access these data except the extention it self right ?

because all my investigation points to somehow they got my encrypted data and then decrypted it somehow, maybe brute force maybe got my etamask password from somewhere , because the day the issue happened not all wallets present in the metamask wallet got hacked so the encrypted data they used was from 2-3 days before maybe more.

I need pointers to where to look in their code to find what happened , keyword, constants etc... that might lead me to the exact lines.

### Scenario

_No response_

### Design

_No response_

### Technical Details

_No response_

### Threat Modeling Framework

_No response_

### Acceptance Criteria

_No response_

### Stakeholder review needed before the work gets merged

- [ ] Engineering (needed in most cases)
- [ ] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [X] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)

### References

_No response_

Start with the suspected Next.js project source code the report mentions, then review its references to MetaMask, browser storage, IndexedDB, encrypted data, and private keys. Compare those findings with the reported timing and which imported wallets were affected; done means identifying evidence that explains the compromise or clearly documenting that the source does not establish a cause.

Written by the indexing model from the issue text.