Absolutely, if hacker steals token, he'll likely using another IP address, so token is bound to IP address, it's a very important security measure. It's easy to issue new token anyway and address does not change often.