...
Good point, but if I was the hacker ... then I will move the coin as soon as possible.
I keep hearing that. Can you explain why?
Because then two people would have access to the coins. The thief would want to move the coins out ASAP so that the owner cannot reclaim them. Likewise the owner would want to move the coins out to another wallet ASAP so that the thief cannot steal them.
Still don't get it -- you mean we're assuming that "the hacker" isn't Master-P? Hasn't this been ruled out?