The only thing I can think of is that I accidentally went to a phishing site and gave them the information they needed to pull this off. I have no other explanation.
I am extremely careful but sometime I get rushed at work and may have done a quick google for the IDEX site and come up to a Phishing one instead of the real thing. I'm praying that this is what happened and I can just chalk it up to me being a stupid idiot.
I guess this can close the case.
You will just have to be careful next time.
That is money we are talking about here and you will really have to slow it down with the transaction.
If I were you I will clean up my Browser history, cache and auto log ins. Google also have the history of what site you have visited and you might want to clear that out.
Maybe next time use an incognito if you are really in a hurry.
RIP to those tokens. Move on and make another.