“I didn’t click anything suspicious” is common after overnight drains.
The damage usually came earlier: an approval or signature that you had forgotten about.
Defense: keep vault wallets isolated, sign less, review approvals, revoke often.