Finally got an answer from their support (3 days after I messaged them frantically). They claim someone else must have had my password and PIN number, and said the transaction was done from a certain IP address. I checked the IP and it's a TOR exit node.
I replied that it's impossible my password has been compromised, as I used a very long and random password, have a lot of technical experience and take great good care of my computer so I'm sure it's not infected with any info-stealing/keylogging malware. I also raised the possibility their side has been compromised. Only 2 days later I got a message back saying they will look into it, and that I'm the only person who reported something like this.

Have you tried contacting their support already?