There is a pattern on most of these hacks. Hackers move the funds from one wallet (node) to another just to hide their trace. Hard to follow the money. Probably the easiest way to reduce these hacks is a temporary hold of the funds for a certain period of time. For example, if a wallet / account receives 1M Sats in a transaction, you would only allow out max 20% of this amount in the next 24 hours. If in 24 hours you receive information from other wallets concerning suspicious transactions, you can still return 80% of the funds. Yes, I know, it can be a inconvenience for legitimate wallets / accounts, but for safety reasons it could be acceptable.