Thanks for explaining more in details what happened, quite a story. Well, panic is rarely a good advisor in crypto, but some bad things happened before you panicked already.

OK, so you use some sort of cold wallet setup where you sign a transaction on a live Linux that you boot up and which shouldn't be online to remain cold. I assume this live Linux isn't persistent or is it?

The part I don't understand and which kicked off a stream of bad events: why do you have your unencrypted seed phrase (the mnemonic recovery words as I assume) on a SD card? Likely out of convenience to re-create your wallet on the "cold" live Linux?
This is bad, especially when you apparently loose control and the SD card can become "hot" on an online system.

The next bad thing was to deviate from your usual transaction transfer and signing process.