Except that you can't prove that you didn't just use a VPN to do it yourself.  This is the problem unless you can get some evidence of a specific person doing this then you are just as much a possible suspect as anyone else.  In fact you are likely more of a suspect because you had access to the password already.  Can you see why this is going to be a problem?

Internet transactions and connections are inherently risky.  Poloniex is NOT the custodian of your account, you are.  YOU alone are responsible for the security of your account and password.  That information very well can be compromised from a Poloniex database, but you are still responsible if there are losses incurred. 

If you brought a case against them you would need to be able to prove that Poloniex was hacked and you have no way to do that.  If Poloniex at some point announced their database had been compromised then you might have the ability to bring a case.  If not you would need to get enough potential victims together to convince a judge or attorney general that there was something bigger going on to issue a search warrant or evidentiary discovery of logging data then MAYBE you might find the info you needed to potentially prove a case.  The problem is you will need likely at least 5-10+ victims totalling enough money to convince a lawyer willing to bring such a case against them.  In the end though their defense has the simple task to say that you made the choice not to protect your account using all means available to you and they have done all their legal due diligence by providing multi-layer protections to prevent unauthorized access and you chose not to use them, therefore you are at fault.

You're going to have to throw more money at the problem to even have a semblance of a chance to get this moving.  It sucks that this happened and I'm sorry to hear about it, but this was a risk you took, not Poloniex.