I'm trying to piece together their logic, and I think the starting point is this: the sender of a lightning payment gets to see the recipient's invoice, and sometimes the invoice has a "node key" in it that belongs to the recipient. When the thief withdrew stolen money from Blink, he gave them an in...