Beside the api thing, did you guys use a wireless lan connection?
If somebody logged in from your ip its just logical that there cant be logs except for the mac address and even that can be spoofed.
An attacker can indeed hack the wlan network and from there into your pc, and no, this is not fiction.
Totally agree that's no fiction, and whilst I cannot comment for the OP, I find it hard to understand how someone could hack my pc (no PC anyway), hack my iphone, hack google authenticator, change API security, create API keys and then execute 2600 transactions.