Yeah, guys. This is my bad. Got the same. Just relelased security update. This is was because json.config was was available for viewing from user's perspective. Very stupid mistake from me as an experienced dev...
ALready contacted with Mex, but not sure if it helps to get money back.

How much did you lose? Not sure, but maybe I can cover your loss.

Now your api keys are secured. (need to redownload and change .htaccess file).

P.S. Also, did you change default admin/pass?