
But the question is you disabled your api's withdrawal access but the hacker did a success withdraw, how is that possible.
The big question and very strange situation!

I spoke to Vitaliwit in the Russian section. There are more screenshots and from the support response makes it clear that they can not understand which API key has withdrawn the balance. They also talk only about 6 keys, but on the screenshots above they are more than 20. The activity log shows no changes to the key rights from the hack date to today and on the screenshots no keys with withdrawal rights...
Russian topic:
https://bitcointalk.org/index.php?topic=5121306.0