There is some logic of burying wallet.dat files in various places in your systems and monitoring them. If/when they go missing, you know you have a problem.

Possibly set-up a periodic cycling system that drives the intruder to move them now, before they get cycled and might lose their bounty forever.