In a ransom attack, the attacker doesn't steal the coins but controls your access to them. By locking you out, the attacker can negotiate a payout to release the funds back to you. This can be executed by manipulating xpubs, especially in setups like 2-of-2 multisig.