I know Ventoy and use it myself to easily boot various systems from ISO files. Very convenient tool.
I still don't quite see the need to store the mnemonic recovery words even on an encrypted flash medium. Your wallet files belong there because of the non-persistance of the live Linux you fire up.
Having the mnemonic recovery words on digital media, I think always poses the risk to mess up in some or another way.
The real question for me is how another address ended up in the transaction. If I was hacked, why wasn't the entire amount sent to that address? I tried to cancel the transaction, but the replace-by-fee attempt failed. The block explorer says it was spent as a fee—does that mean I managed to stop it from going to the hacker's address, but instead it got spent as a fee? If so, how is that even possible? I double-checked, and Sparrow Wallet doesn't allow a fee higher than 8k sats... This is what I don't understand at all.
This is (for me) the more interesting and tricky part to dissect and understand what was going on.