Why did you do that OP? What was the point to send the thief 10,000 satoshis?
the first transaction for 10,000 satoshi was presumably a "test" transaction, to ensure the addresses were correct and there was no concern regarding clipboard malware, fake QR codes, or whatever. Once they saw those 10,000 sats show up unconfirmed in the thief's wallet, he then made the rest of the transaction.
I thought also about that, but I came to the conclusion that nowhere in the world this could be the reason.
The part of sending money to the scammers addy would make sense as a test, but both were made on the same minute, and AFAIK blocks aren't mined that fast yet
Furthermore, I think that
not even the txID itself can be seen on Blockchain within seconds. Remember that both transactions of 10,000 sats and 1.52 BTC were made at 10:25. As far as I know, the wallet gives you the txID right after the transaction was made, but in some cases the respective transaction isn't shown on the block explorers before some seconds pass (maybe even up to a minute). Besides that, they would also spend seconds in order to access a block explorer, insert the txID in order to search for it; maybe also refresh the page for a few times until they could see the transaction there (although not confirmed -- which implies no test could be done up to this point). All these seconds would make the second transaction to be created at least 1 minute later, not no, the second one was made within the very same minute, at 10.25.
So considering all these, I'm not sure if it was a test or something else. In order for the test to succeed, they would have needed at least a few minutes, for the transaction to receive confirmations and to appear in the thief's wallet --
in case the transaction was processed in the very next block (which is also not necessary to happen); therefore, if it was a test, then the second transaction (the 1.52 BTC one) should have been made after several minutes and, in any case,
not within the very same minute as the "test" one...
That's why I'm asking OP -- something doesn't tie up here...