Attackers minted unbacked LBTC, drained reserves, then returned most funds