I mean from a probabilistic standpoint theres no way to reach a large number of users before alerting hackers. Even inside the CC userbase you will have opportunistic hackers who will steal. Theres no way to win that race. The full stealth way is to attempt to ship fixes without alerting anything or putting it in the patchnotes, but that cover will be blown instantly when they see their coins moving with the new update and you need to move the coins to a new seed for any fix, which requires the user to send the coins off the device and is gonna tick off even the most amateur users. Genuinely the only way is for them to steal everything themselves, then set up a multi factor and case by case process to verify individual users and send them their coins back. I think it's possible to do this and reach a 95%+ recovery rate, but it requires creative verification and will still probably lose user trust forever, but NVK could still recover personal credibility and show his face in public even if no one trusts his code ever again.