Me too, I thought whoever found the private key would go through Mara's slipstream, that no one would dare go through mempool directly but how wrong I was.

The thief who stole the coins must have a nice setup, it took his bot 45 seconds to replace the transaction, I assume whether he used BSGS or Kangaroo, it took 30 seconds to find the private key and the remaining 15 seconds for opening and shutting down apps.