Yeah, that's a big vulnerability. Crypto transactions being irreversible is a valuable feature, but being able to invalidate money is like reversing a transaction.