Best way to navigate a compromised private key

Like the title says, I have a compromised private key. I am pretty sure the thieves are watching the address. The address is currently the refund address for some tokens locked in a smart contract. Is there a set of best practices that I could use to activate the refund and then make sure that my transaction is the one that moves the tokens to a safe address once recovered?