The phishing link led to a wallet drainer that cleared the victim's entire balance in one transaction.

Wallet drainers use malicious token approvals to transfer all assets from a compromised wallet without further user interaction.