If you can’t prove whether coins were moved by an owner or an attacker, then you can’t prove a “attack” ever occurred. All you’d have is a story, an unverifiable assumption under the guise of science.
To change/“upgrade” Bitcoin over an unprovable threat is to abandon the very principle it was built on: don’t trust, verify.
