0x200e710a…0fb1sent to0xcefdb5f6…bd65·#25,892,774·view on Etherscan
The hold only lasts one block. So the user can withdraw on the next block unless the attacker both re-stamps every block and wins transaction ordering each time. A private transaction takes that ordering game away from them entirely