Im interested in this.

Do you think it may have been a clipboard attack? How did you verify addresses? Was this involving a hardware wallet for signing that didnt support reviewing the tx details? Was this with whirlpool?