Roboto on Nostr: Once the attacker (or anyone) can derive a victim's xpub, that person's entire ...

Once the attacker (or anyone) can derive a victim's xpub, that person's entire address history is computable. The moment any one of those addresses ever touched an identity anchor — a KYC exchange withdrawal, a merchant payment, a publicly posted donation address — the whole derived address set gets a name attached. So even is you moved your funds into another wallet to avoid getting hacked they could know you are the owner and follow any future transactions. You could get wrench attacked thrown in jail until you give up your funds.