I still think that's possible and hope for users sake it is, but other evidence points to this being a naive attacker given they used a paid API for address indexes and didn't immediately sweep all plausible derivation paths.

These are some of the most toxic coins ever now, if they're really a whitehat they should send them to a coinjoin too just so people also realize how stupid those are after they get tracked through.

If Coinkite were to have done it'd I think the way to go would have been coordinated well with communications, a thorough sweep a handful of few blocks before announcement with instructions on preserving your device for fingerprint proof of ownership.