Jason from MintPal just said on IRC that it wasn't a hack and that that all KARM and PENG is safe. He will update soon.
Well I can tell you what the problem was. It was a "dupe" when you withdrawl. Say you withdraw 1btc, so everything goes good then 2 appear in your site wallet. then you can xfer the 2 to your wallet. then 4 appears. etc etc. So, it was a problem on the sites end. They fixed it when we were talking about the problem and he saw it. I guess he did an audit and saw some were missing.
so someone just draw all BTC in to his exchange wallet, but he was not able to withdraw it out?