Phishing patterns that exploit exposed wallet mnemonics/private keys and sweeper — known cases and variants?