I can confirm, the tokens have been grabbed by someone else. You can verify this reading the server response in the browser inspector:

tokens already spent. Secret: .....

A little bug prevents the correct popup message