It is hard to believe that cryptopia would store coins in an insecure hot wallet. I think it was an inside job, done by technical staff that had access to certain passwords