I Creating A Transaction That Including ETH, While There Are Other Transaction That Including The Same ETH On MemPool.

Example(This Is What I Mean In My First Reply):
1.I Sent 0.2 ETH To The Hacked Address
2.The Hacker Sent The 0.2 ETH To The Network(Waiting New Block)
3.I Immediately Sent A Transaction With Same Nonce Consisting Of Sending 0.2 ETH To My Non-Hacked Address.
4.The Hacker Know That I Want To Spend 0.2 ETH, So He Created New Same Transaction With Higher Gas
5.I Doing The [Step 3] Again But With Higher Gas
6.The Hacker Doing [Step 4] Again But With Higher Gas
7.The Loop Will End When New Block Was Found.

On The Ethereum Network If There's 2 Transaction Spending Same ETH(Same Nonce), The Miner Will Pick The One With Higher Gas Price (Not Transaction Fee)

INFO :
-Ethereum Average Block Speed Is Around 17 Second
-Hacker's Double-Spend Attempt Has A Delay Around 1-2 Seconds

If Your Transaction get Confirmed Before The Hacker Do The Double-Spend. The Transaction Is Success.
Sadly The Block Time Is "Random" Around 10-20 Second So You Need To Do Some Attempt(And Some Luck) Before It Works.