You store the xpub in an unencrypted database to begin with; you just have to look for dojo servers and exploit the different vulnerabilities they have, which are many, to know all the balances 😂