Go look at that address on mempool and see if the sats are still there or if the attacker moved them.