Recently i received around 1400 USDC on my Ethereum wallet that I access through Metamask. Today I opened Metamask because I wanted to transfer those USDC, but I found that there were no USDC anymore in my wallet.
This is my address on etherscan: https://etherscan.io/address/0xa1ed7b3740994bd6919483405a35264f9f57e506. Looking to the ERC20 token transfers, I found out that around three days ago there is a transfer of my 1410.21 USDC to 0x532D6c35178195Dde7ff21510eB77d6FF8f08844.
I never signed this transfer transaction, and I have never interacted with any DeFi protocol or website using the wallet where i was holding the USDC (0xa1ed7b3740994bd6919483405a35264f9f57e506) on Ethereum, but I have interacted with Defi protocols on other chains with the same wallet. I also never shared my metamask password and private key by any means. The only potential problem that I see is that the metamask password is the same password that i use for many other web2/web3 authentications (so it may have been leaked somehow).
I can't understand how the attacker was able to steal my private key. If we look into the suspect transfer transaction (https://etherscan.io/tx/0x233bd512a359b6e0863355fcb0e79dc45cc8b107484d1e68785220e9b7e26820), we can see that the "from" is my wallet address, so I deduced that the attacker must have access to my private key, otherwise they wouldn't have been able to sign the transfer transaction.
Moreover, I have around 250$ worth of other tokens in the mentioned wallet (on other chains, not on Ethereum), but they have not been stolen, and I don't understand why.
I understand that I don't have many chances to get my funds back, but at least I would like to understand what happened and how should I act now.
Thanks in advance for any useful answer.
Edit: Looking at the scammer's transactions i found that there is another account (0x76A02bB3d4E6fCb32643A9cA38569f1A959b9d2c) from which 437.5 USDC were stolen by the scammer: the interesting fact is that those 437.5 USDC came from a Disperse.app transaction (https://etherscan.io/tx/0x2b693ee3dad3c72f576438e6a4013ac6f5136bc1f580075a8234f97e45f1dc04) very similar to the one from which my stolen USDC came (https://etherscan.io/tx/0xf89c5dbfde1a777450d37e4c787837209ffd520e8d4aa9095e04131b579ecc25). They are similar because they are both transactions that distribute USDC to various addresses using Disperse.app and the signer is the same address (https://etherscan.io/address/0xe993486b257cd1481aef74b3b909a2627fc8d305). To add a bit of context, i won the stolen USDC at the EthGlobal Paris hackathon, so i guess that they used Disperse.app to distribute the prizes to the winners. This makes me think that also the 437.5 USDC that were stolen from the other account that i mentioned should be an EthGlobal prize, and makes me wonder if this could mean anything in particular. Maybe the private keys theft happened in the context of the ethglobal hackathon? It feels strange that the scammer was able to steal from (at least) two addresses involved with the hackathon, given that the total number of scammed addresses are not so many.