It is released and confirmed. If necessary the attacker himself provides the first confirmation, which connects it to a recent tip. The transaction looks legit.