I would like to ask one thing that may also be related to this case.
If someone uses an automated trading bot on a testnet network and downloads another person's bot script from github, could that script potentially compromise or drain funds from their personal wallet?
A friend of mine has been experiencing this issue. Every time he funds his wallet again, all of his assets end up being drained. This happens even when he creates and uses a completely new wallet. He got the bot script from a friend who sent it to him via telegram.
It's hard to say. If your friend made the mistake of running an unknown script from an unknown person who promised him that it would help him make money, who knows what other mistakes he did. A script could definitely be the reason why that is happening but so can other things. I am sure some people believe that everything on GitHub is safe. It's not. Your friend should use common sense in the future. He should also reinstall his OS and check the wallets he uses if there are some permissions allowed that shouldn't be there.
Based on the user's remarks above. I think his friend is going through exactly what you mentioned in the OP because there is no assurance that the trading bot script that was copied from GitHub has been publicly verified by a reliable team, and as of the last time I looked, not all script code on GitHub is worth using especially if it's from the developer that does not have a name or reputation to protect.
