New withdrawals are currently on hold while I work through the future of the exchange.
That is unacceptable. Regardless of the future of the exchange you have an obligation to disburse funds to the ACH account on record. You previously handled requests by email. USD funds by depositors are the property of the depositor and not an investment. You have no legal standing to hold those funds pending "anything".
I agree with TangibleCryptography.
In your own words:
I know exactly how much each user currently has in their account for both USD and BTC. No records were lost in this attack.
Unless you have gotten legal advice to the contrary (if you have please let us know), I would advise processing ACH withdrawals on a as needed basis.