Somebody got your private key if you did not transfer then someone has your private key metamask is safe they are just a tool to interact to a verified erc20 sites or application, they cannot make a transfer someone has access to transfer funds better create another metamask account and protect your private key.