The attacker was able to empty the balance on accounts with the API key enabled. The issue is being actively looked upon.

Everyone who has lost money will be fully reimbursed.