attacker used ssh to gain access and steal btc wallet. i discovered this while trouble shooting a customer who had not received his deposit even though it showed pending. then i discovered our btc wallet was drained, all the accounts gone and the wallet.dat missing

Update
the coins were recovered a short time later. we are paying out withdrawals and asking all coins to be withdrawn from the exchange so that we can start from scratch.