no you will not have lost your tokens. It takes 3 days to unstake your tokens, after that they should go from "refunding" to "available".
Things to note are:
If you unstake again before the current unstake is finished, then the refund timer will be reset to a 3 day wait.
Sometimes, the money is unstaked but the "refund" action to convert them to liquid EOS ...
If you see the system_contract::delegatebw, you will know that Stake is transfer to a third party account and make a record.
If you want do the things you mentioned:
have trusted stake account
hold the sellerer's value in stake account
hold the buyer's price in stake account
make an inline transaction to exchange them
You can use cleos to undelegatebw:
cleos -u https://api.eosbean.com:443 system undelegatebw youraccount1 otheraccount "0.1 EOS" "0.2 EOS" -p youraccount1@active
In which, youraccount1 is your own EOS account name, otheraccount is the other (child) account name, 0.1 EOS is the amount of EOS to undelegate for NET, '0.2 EOS' is the amount of EOS to undelegate ...
Here is my basic incident response plan if an EOS account I control is hacked:
Regain control of the hacked account by changing the owner/active key pairs
Identify all transactions if any that were done without my real authorization but with my active or previous owner key pairs
Contact block producers on the telegram channel @EOSProsto and get further ...
As I never did this, do I load my OWNER private key into a new wallet and then change the active key to something else to prevent the hacker from doing anything?
Or is there another step I do not know about?
If you want to or if you believe that the wallet you used may be insecure, you can generate new key(s) for the owner and reset your owner ...