Update: funds were not stolen. PortableSecret wasn't cracked (yet)!
What happened is: the wallet app I'm using automatically performs CoinJoin[1] when funds are received (In fact, this is their business model! They take 0.3% of the amount to automatically anonymize all inbound coin).
CoinJoin is a protocol that breaks up the sum received in tiny pieces and scatters them across a large number of "sub-wallets".
So my wallet still has the funds. Bt the 'receive' address I used looks drained, that's because it was only a temporary address to share with the sender. Funds were soon after scrambled/tumbled/anonymized.
This was an interesting experience. I spent all day thinking about what could have happened, researched and learned a bunch of stuff in the process.
[1] https://en.bitcoin.it/Privacy#CoinJoin