that still doesn't explain why only some of the private keys are being compromised.

if it's an RNG weakness, then isn't an attacker still just "searching" for coins, and as the UTXOs turn up, racing against other attackers to claim them?

so there is also a secondary "game", of building transactions that are likely to get mined ASAP, rather than just huge dust sweeps that end up mostly rewarding miners.