What if the attacker publishes the migration event first?
Login to reply
Replies (2)
you get a 60-day time window to publish a new migration event pointing to an older one
full spec: 
GitHub
NIP-41: simple account migration by pablof7z · Pull Request #829 · nostr-protocol/nips
This NIP introduces a simple way in which a pubkey can migrate to by whitelisting a new pubkey ahead of time.
TL;DR:
Pubkey A whitelists Pubkey B ...
Thanks. I'll give it a read.