The attacker used RBF to steal the coins from CC users who were trying to move them off to a different address. I think a total of 34 bitcoin were stolen this way. So far. CC users are in a very bad place right now. They can’t export the bad seeds on another device. And they are at risk to move their UTXOs to another seed/device bc the attacker can intercept them with RBF while awaiting confirmation on chain.