As long as Russia held their Bitcoin reserves in addresses to which they had exclusive and secure custody of the private keys (and they would be utterly insane to do anything else) there would be no way their assets could be stolen. The Bitcoin network will not process a spend transaction which is not signed with the secret key corresponding to the sending address of the transaction. Due to the manner in which the one-way hashing function is used to generate the public address from the secret key, a validator processing the transaction can verify the submitter of the transaction possesses the correct secret key without knowing its contents.
A validator who fraudulently certified the transaction and published it to the blockchain would immediately be identified by any of the hundreds of thousands of other full nodes who independently verify the correctness of each block they receive and flag the block as invalid and the miner who published it as a rogue. The block would never receive the required number of confirmations and be rejected as fraudulent.
Processing a spend transaction without a valid private key would require co-opting more than half of the full node operators on the network, and there is no plausible way to do that without a radical restructuring of the architecture of the network which, itself, would require a hard fork which was adopted by the overwhelming majority of the miners and node operators.
Whether it would be possible to freeze transactions from addresses identified as Russian reserve addresses is a more complicated question. First, they would have to be identified as such. If, as is considered best practice with Bitcoin, a new address was used for every incoming transaction and the funds were not further consolidated, it would require all senders to identify the receiver as Russia. Assuming the reserve addresses could be identified, Bitcoin to legacy currency exchanges who were cooperative or could be coerced could refuse to perform exchanges for funds from identified addresses and seize the Bitcoin sent to them. This appears to be the approach being taken with the proceeds of the US$ 625 million Ronin heist I wrote about here on 2022-03-30.
One could imagine a scheme where validators would reject (refuse to publish on the blockchain) outbound transfers from blocked addresses, but that would require a mechanism which does not exist and would require cooperation of most validators to put into place. Notably, the address which received the purloined funds from the heist continues to transfer funds out without impediment.