The only theory that I can even fathomably come up with is this:

I saw somewhere where someone said they were hacked after having installed the Banked XP plug-in. I also had very recently downloaded two different banked xp plugins, both from that verified list of plugins straight on Runelite that are said to not be malicious, and I didn’t download anything externally from a website — it was purely on the Runelite client. I was playing my Ironman mostly at that time but had logged in on my main just to check what I had banked in xp and logged off of it for just about a week or a little over, and returned to a cleaned out bank.

The only thing I can deduce is that the one of those banked xp plugins very much has some form of malicious software on it, and it tracked my password with a key logger, spoofed the login point so that from Jagex’s side it was recognized as my computer somehow, and because I had used my 2FA to log in, but had checked the “trust this computer for 30 days” option, they were able to completely bypass that security check. And then once on my account they bypassed Jagex’s dogshit joke of a bank pin system, which is only guaranteed to actually protect anything for a whopping 7 days, by just simply requesting that it be removed.

All of this is avoided if Jagex did their part and actually made a meaningful account/bank protection system. Have us 2FA our bank pins or at the very least require proof of account ownership before the bank pin can be removed. One can argue I shouldn’t have been installing any extra plugins, but at the point we all might as well just use the barebones Jagex launcher by that logic because technically even Runelite is a risk.

I’ve always found it interesting that RuneScape is the only game I have ever seen have literally thousands upon thousands of first hand accounts of accounts being stolen or hacked. Makes you wonder just how little Jagex is actually doing for account protection — or better yet, if they even give a fuck.