user137434: If you saw a transaction from a UTXO you control in the mempool that you didn't sign (i.e. it was stolen), could you use RBF to move it to an address you control before it was confirmed?

user133407: Yes. All bitcoin transactions that signal RBF (Tx1) can be cancelled (replace output with yours) using some wallets with Tx2.
Wallets that support cancellation by RBF:

Bluewallet
Electrum
Sparrow

Tx2 could be then replaced with Tx3 by the attacker using RBF as Michael mentioned about the race in his answer.
Attacker could also use CPFP for Tx1 in combination with or without access to whole wallet. You can do CPFP if there was change in the transaction that belongs to your wallet.

Cancellation of unconfirmed RBF transactions would also be possible in Bitcoin Core if PR #25344 is merged.

user47827: The attacker would have needed to access your private key to sign a valid transaction. If that happened and you observed the transaction in a mempool then you could broadcast a competing transaction with a higher fee rate. It would then be a race to see which transaction got mined and included in a block and the attacker's transaction would have had a headstart (it would have been propagated across the network for a longer period of time).
This isn't technically RBF, RBF generally refers to bumping the fee for a transaction spending to the same destination.

137434: <p>If you saw a transaction from a UTXO you control in the mempool that you didn't sign (i.e. it was stolen), could you use RBF to move it to an address you control before it was confirmed?</p>
 133407: <p>Yes. All bitcoin transactions that signal RBF (Tx1) can be cancelled (replace output with yours) using some wallets with Tx2.</p>
<p>Wallets that support cancellation by RBF:</p>
<ul>
<li>Bluewallet</li>
<li>Electrum</li>
<li>Sparrow</li>
</ul>
<p>Tx2 could be then replaced with Tx3 by the attacker using RBF as Michael mentioned about the race in his answer.</p>
<p>Attacker could also use CPFP for Tx1 in combination with or without access to whole wallet. You can do CPFP if there was change in the transaction that belongs to your wallet.</p>
<hr />
<p>Cancellation of unconfirmed RBF transactions would also be possible in Bitcoin Core if PR <a href="https://github.com/bitcoin/bitcoin/pull/25344" rel="nofollow noreferrer">#25344</a> is merged.</p>
 47827: <p>The attacker would have needed to access your private key to sign a valid transaction. If that happened and you observed the transaction in a mempool then you could broadcast a competing transaction with a higher fee rate. It would then be a race to see which transaction got mined and included in a block and the attacker's transaction would have had a headstart (it would have been propagated across the network for a longer period of time).</p>
<p>This isn't technically RBF, RBF generally refers to bumping the fee for a transaction spending to the same destination.</p>
