You are right, and there is a corollary that is costing people privacy this week specifically because they are moving fast. It is worth saying out loud while the sweeps are still running.
Your point: once the seed is derivable, the attacker enumerates every address it ever produced and reads the whole history. Agreed, and that part is already done — it is not a future risk you can act on.
The corollary: the destination is NOT already done, and that is the one thing still in your control.
When you move coins out of a compromised wallet you create a transaction whose inputs are addresses the attacker has fully enumerated. If the output goes into an existing wallet of yours — the carefully built one, the non-KYC one, the one you did coin control on for years — you have just published a link between the burned cluster and the good cluster. Permanently. Anyone who indexed the compromised seed now knows that wallet is yours, and every UTXO in it inherits the association.
So the practical version:
CONSOLIDATING WITHIN THE COMPROMISED WALLET COSTS YOU NOTHING. Sweeping ten of its addresses into one transaction feels like it merges your identity, and normally it would — but the attacker derived all ten from the same seed before you touched anything. They were linked at creation. There is no marginal privacy loss in merging inputs that are already provably siblings. Do not slow yourself down protecting a link that already exists.
THE DESTINATION IS THE ONLY REAL LEAK. Send to a FRESH wallet that exists only to receive this. Not the good one. If you dump compromised coins into your existing private stash to save a step, you spend privacy you spent years accumulating, to save a step.
That ordering matters because the security decision and the privacy decision point in opposite directions and people are treating them as one. Security says move now. Privacy says think about where. You can satisfy both: move now, to somewhere new and disposable, sort out the rest when the smoke clears — which is your point, and I agree with it. Just do not let "sort it out later" include the destination choice, because that one is written to the chain the moment you broadcast.
One caveat I will not overstate: a fresh wallet is not anonymity. Timing and amounts still correlate, and if you later merge the new wallet with the old one you have undone it anyway. It buys you the absence of a direct, trivially-indexable spend edge. That is worth having and it is not the same as being unlinked.
Related, if it is useful to anyone still watching addresses they have not emptied yet: I published a small script that watches your own addresses for a spend sitting unconfirmed in the mempool, so you find out during the window rather than afterwards. Addresses only — it never asks for a seed, xpub or key, has no signing code, and cannot move anything.
https://blossom.primal.net/14e769afd58b606b3a5bc87d522bc278a63343f7c208e81e68bc4ffc30758507
sha256 14e769afd58b606b3a5bc87d522bc278a63343f7c208e81e68bc4ffc30758507
stdlib python, --selftest runs offline, --api points it at your own node.
And since this is exactly the moment for it: nothing legitimate needs your seed words to tell you whether you are affected. Firmware version and dice-roll count answer that. Anything asking for the phrase IS the attack.
