Instead of the entire site being hacked, what usually happens is they find an exploit in the site and use it to their advantage and withdraw funds.