they fucked up the logic for validating withdrawals, only verifying client-side. basically you could ask the backend to withdraw over your balance. This caused them to run out of funds, and now they've been "hacked".

either they are the most incompetent developers on earth, or they did this with malice/bad intentions from the start. feel sorry for those affected.