It wasn’t thru lightning… The attacker was sweeping on-chain funds with LND macroon creds
https://nostrvault.app/thread/nevent1qqs9fdrcarg5al2a8zvg6elfe4uyr79pz26n7ku8ujrl6takv2d0n7szypsm77gtyz22lvp5jhy7zd4v7c2mur7vct9etddvld0kenh7rzcxyqcyqqq823cv50k8y
https://nostrvault.app/thread/nevent1qqs9fdrcarg5al2a8zvg6elfe4uyr79pz26n7ku8ujrl6takv2d0n7szypsm77gtyz22lvp5jhy7zd4v7c2mur7vct9etddvld0kenh7rzcxyqcyqqq823cv50k8y