We might never know exactly what did lead to the loss of the coins from CC.
I know fungibility is one of the key facts in Crypto. But what are the actions right now ?
Sure the foundation could just do nothing and let the markets collapse when the hacker is selling, but how would that help anyone involved.
In a true decentralized way, there is no possibilty to just hardfork and move on like ETH did.
How I get it is, that the devs try to flag the accounts and make it at least harder to sell the stolen coins. They can just help sending those mosaics, but anyone could develop such a tool and send mosaics. Whether it helps the exchanges in the longrun is not in the hands of the foundation. But that´s a good thing. They can´t "solve" this issue, but doing their best.
I would love to hear your solution/way to do it better
The best (re)action "right now" is doing nothing.
Don't try to "help." That is counterproductive.
Those who formerly had NEM on a vulnerable exchange deserve to lose their coins. They are by definition weak hands for letting someone take their coins.
Helping them with convoluted, unworkable tainting nonsense only encourages them to make the same mistake again.
They need tough love so they learn a lesson, not indulgence so they learn to depend on bailouts.
The best thing is for the stolen coins to be redistributed into stronger hands. The attacker has already taken the first step by helping himself to the weaklings' coins.
The next step is to sell them off and hope NEM is antifragile enough to survive and emerge stronger from the harsh lessons in security and fungibility.
The hacker or whatever must be rewarded for finding the vulnerability, or it will discourage others from pen-testing. The mechanism for that to happen is for those with empty bags to pay the hacker to refill them. The re-buyers will thus have more skin in the game and not be so greedy and careless in the future. That goes for the exchange as well as its customers.
NEM devs and community must also work on making their coin fungible and their network permissionless and decentralized.
But they don't want to do that. Every architectural and organizational governance design decision shows NEM is fully intended to be the vanity project of one Satoshi-wannabe guy.
If Bitcoin can recover from dozens of MtGoxes and be stronger than ever WTF is NEM's excuse for treating its users like little babies who must be mollycoddled and protected from the consequences of their poor decisions?
Look to Bitcoin's history for an example of leaderless governance and antifragility to emulate. Look to Monero for an example of 100% fungible (IE cannot be tainted) coins moving through a permissionless (IE can't be evil) network.