If you never set a passphrase on your Bitcoin Core wallet, the private keys are stored in plain text. Anyone who acquires the file can open it in a local node and instantly transfer all funds to their own address. Encrypted Wallets
The attacker runs the scraped wallet files through automated scripts that check the blockchain for historical or active balances associated with the public addresses inside the file. Phase 3: Password Cracking (If Encrypted) Index-of-wallet-dat %7CVERIFIED%7C