Update: it happened again. The same wallet was drained for another $25k $USDT by the same scammer.

The malicious $USDT approval is still active, so funds get pulled the moment USDT hits the wallet.

Urgent fix for anyone in this situation
• revoke the USDT approval
• if in doubt, move assets to a fresh wallet first