Weird. It looks like someone was testing his malware backend.
If you want to explain further, I would appreciate it.
Take a look at
the receiving address, and "CTRL-F bc1qs9gxwj6497yk" on that page, then scroll down. That highlights when the address received funds, when it sent funds, and when it sent funds to itself. Some of the transactions are consolidating, but at high fee. Some are splitting inputs. Both actions are a waste of transaction fees.
What does it mean that someone was testing his malware?
It's just a guess because I can't think of any other reason to create such transactions.
In my opinion there are the following options:
1. Someone tried to brute-force my wallet and they succeeded. Highly unlikely. Except if the attacker knew some of my words and therefore were able to reduce the search space.
Is there any possibility to know some (most) of your seed words, without knowing all of them? I guess not, so this is the least likely scenario.
2. Someone saw my seed phrase on my piece of paper. Highly unlikely. Since where I store my seed phrase nobody has access except for me.
It's possible.
3. My BlueWallet app is compromised somehow. I downloaded it from the playstore.
It's possible.
4. My phone is compromised somehow and someone gained access to my phone's storage.
It's possible.
Option 5: someone had access to your phone for a moment, and swept your funds.