Accounts on sites that require KYC such as bank accounts, PayPal, etc. are assumed to be hacked unless you explain why they're not hacked.