Well apparently someone got access to my account and that's why, I still don't understand how having access to my account they where able to send my BTC to a different address like that?
I think you have malware or rogue addon/extension on your computer
and the script steals your bitcoin by modifying withdraw request at the time you enter your password
that explains why the transaction happens only when you request withdraw not immediately after you made deposit
and this is why turning on 2FA email confirmation on withdrawal is important? doesn't Paxful have it?