A bitcoin trader opened a blockchain wallet for me and then sent me my profit but it is non-spendable. I know they can no longer get into my account because I changed the password and I have two-step verification. And I don't see them created passphrase, that means no private key was stolen?
Yea they can still access your wallet.
When the scammer created the wallet, they will have written down the mnemonic seed phrase for the wallet. With this seed phrase, they can recreate your wallet using some other software, since the seed phrase will allow them to derive all of the same addresses. They do not need the password to do this, and changing the password will not stop them either.
Think of it like this: you have a secret (the seed phrase) hidden in a box, and your password is the lock on the box that protects that secret. If the scammer steals the secret before you lock the box, they won’t need your password. They already have the secret!
So, the best thing to do is just never use that wallet (or seed phrase) again, and stop talking with the scammer.
There is no point in them accessing your wallet. The wallet doesn't hold the key needed to transfer the bitcoin anyway -- that's why they show as non-spendable. They didn't send you any profit, they sent profit to their own account and showed it to you. Let's walk through what you said:
A bitcoin trader opened a blockchain wallet for me and then sent me my profit but it is non-spendable.
So it's not your wallet. They opened it. It's their wallet. They configured it so it could see the profits they transferred but not transfer them. That's why they show as non-spendable.
I know they can no longer get into my account because I changed the password and I have two-step verification.
You don't have an account. You never created one. You locked a wallet, but there's nothing in that wallet. They never put anything into that wallet except to allow it to watch their account.
And I don't see them created passphrase, that means no private key was stolen?
No private key was stolen because they hold the private key and never put it anywhere you could get it. They hold the private key and then they created a wallet for you that did not contain that private key.
Can they still access to my wallet?
No, but so what? The wallet doesn't have the private key anyway.
I'm the simlar situation as below thread, but how do I know private key was taken?
It wasn't. You never had a private key. That's why the funds show as non-spendable. You do not have and did not ever have the private key.