Hi,
timestamps show hijacked coins txs correspond with :
"GET /api/walletEx?address=YOU_COIN_WALLET%20or%20TAG%20for%20Wallets%20substitution HTTP/1.1" 200 5 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
we're digging and monitoring.. will keep you posted if we stumble on more info or reach solutions
regards,