Let's consider the following algorithm
enumerate all of the private keys
for each of the enumerated private keys, generate the relative public key and verify whether there is any unspent coin associated with that public key
if there is any unspent coin, transfer those coins to an address owned by the attacker
Would an attack like this work?