If your mnemonic is stolen/compromised, and you have not yet set a withdrawal address, you should attempt this immediately to prevent permanent lose of funds, before the attacker irreversibly designates their own withdrawal address for your validator.