The finder of 69 decided to start off by scanning every 11th range, beginning with 10000000, then 1000000B, 10000016, 10000021, 1000002C ... kept doing that until while scanning the 175,830th range, found the key in 101D8327. Aware of the risk of broadcasting directly to the mempool, the finder opened up an outdated version of Electrum to craft the transaction which would be sent to Mara Slipstream. A prompt to update Electrum to its newest version appeared, which the finder chose to update, and that "update" was malware that then broadcast a transaction directly to the mempool. Pretty much the same story that happened to one guy in 2020:

https://www.coolwallet.io/blogs/blog/1400-bitcoins-btc-stolen-from-an-outdated-electrum-wallet