Me too, I thought whoever found the private key would go through Mara's slipstream, that no one would dare go through mempool directly but how wrong I was.
The thief who stole the coins must have a nice setup, it took his bot 45 seconds to replace the transaction, I assume whether he used BSGS or Kangaroo, it took 30 seconds to find the private key and the remaining 15 seconds for opening and shutting down apps.
kTimesG bragged about having a very fast setup and also started precalculating tames for 66bit, 67bit... Preparations you would only need if you plan to steal the transaction sitting in the mempool.
Every other user that took part in the stealing-bot-script discussions a few pages ago is suspicious.
The thief likely active here but would never confess because of repercussions...and well he is an asshole

.