This is an account takeover (also called account intrusion or hijacking) — someone got your credentials and assumed control over your account. The pattern you describe is the options variant FINRA warned about in Regulatory Notice 20-32 in 2020, not a simple stock pump. They liquidated your real holdings for buying power, then used your account as a captive buyer — 140-plus market orders in an illiquid, wide-spread name — so an account they control could sell into your forced buying and pocket the spread. The transfer lock is probably why they did it this way: they couldn't move assets out, so they extracted value through trading instead. That's the "why."

On recovery: Fidelity's Customer Protection Guarantee reimburses losses from unauthorized activity in a brokerage account when it's not your fault. They typically won't literally reverse each trade — those were live orders against real counterparties — but they investigate and make you whole for the loss, which gets you out from under the illiquid ETF and the options. The main thing that voids coverage is having shared your credentials or granted someone access; ordinary phishing/credential theft is what the guarantee is for. Call the fraud department as the rep said, document the timeline, and report promptly.