How Does a Malicious Attacker Attempt to Steal Funds Using a Compromised Address?

If an attacker has compromised the private key or seed phrase, they simply create a new transaction that sends all the funds from the compromised address to an address they control. They then sign this transaction with the stolen private key and broadcast it to the network.

The network validates the signature and processes the transfer, leading to irreversible theft.