pull down to refresh
I still think that's possible and hope for users sake it is, but other evidence points to this being a naive attacker given they used a paid API for address indexes and didn't immediately sweep all plausible derivation paths.
These are some of the most toxic coins ever now, if they're really a whitehat they should send them to a coinjoin too just so people also realize how stupid those are after they get tracked through.
If Coinkite were to have done it'd I think the way to go would have been coordinated well with communications, a thorough sweep a handful of few blocks before announcement with instructions on preserving your device for fingerprint proof of ownership.
I was talking to @optimism about someone potentially trying to replicate the attack for the purpose of safeguarding vulnerable funds and trying to return them later.
It’s a bad idea for a bunch of reasons, in the current context, but maybe ColdCard would have had to do something like that.