Though it is possible there are some withdrawals that weren’t backed by any deposits.

You don’t need to steal a wallet if you can update your account balance and then do formal withdrawals through the front-end.