1) Only Ethereum is stolen
2) Even if users' coins are stolen, they might return all or most of them to their hands in order to keep their dignity.
how can they do this?
most exchange have an insurance to cover the lost when a disaster comes.I think Cryptopia will reimburse because its a security breach on there side. there website is not secured enough