How hackers steal tokens