I have a Coinomi app on my smartphone for a long time, and a clean smartphone, no weird apps, not rooted...
I didn’t use app to hold Cryptocurrencies, I just used it to withdraw Bitcoin from my paper wallet, and I wanted to send it to BlockFi.
But yesterday when I scanned the private key from the paper wallet, the address for sending BTC to another address also appeared in the transactions at the same time.
I contacted customer service, and they asked how many recovery phrases I have, I only have 3 (I haven’t changed that from the beginning).
They say it’s my fault, that I should have 24 because 3 is insecure, and they can’t do anything about it.

I don’t know how that’s even possible, I have to wait for confirmations so I can send bitcoin further, and hackers obviously don’t have to?
Can I report this to anyone?
Should I report it to the police?
Can I track the address, and wait when they will try to cash out.
For me 0.1 BTC is a lot of money, if possible, I’ll follow them or him forever.

Thanks in advance, for the advice.