exact method:
guy tried to blackmail me, i didnt care but was interested in his OSINT skills
talked to him for a while, had previous drains so paid him some for doing DD on them
he sent me results of dd using links for a while, i asked for text
he sent link which led to website which automatically downloads + executes masked as etherscan link (so couldn't be avoided with TG "no download" and other methods")

my retarded ass first "checked" those clicks from phone on which i had second multisig signer + he also got same way access to my TG metadata