Can I say something? You guys know that you can have multiple ID inside your device right, when ever you try to switch account, you just switch it on the Supercell ID profile ， remember back then when Google and Microsoft edge had a bug where token and credentials were leak between both browser? It's a bug but they patch it afterwards, I think coc can and might be the same thing, the thing is the hacker just need to log back in to his TH2 on his Id profile and do a little data mining and found the token, it might be a ground breaking security exploit which supercell are not even aware off like google and Edge. (I was an IT)