At the very least, Coinpayments -- or any third party service -- will require a police report. That's hurdle #1 for the OP, and time is of the essence.
For getting back their coins most likely. But if coinpayments is indeed the exchange that received the coins there's no harm done in contacting their support and triggering an investigation. Best case the account containing the stolen coins gets frozen until matters have been clarified.
No harm done, but they still need to move quickly to get a police report because third parties don't have the authority to freeze funds indefinitely. This is
Binance's policy for these situations:
The victim must provide a police report within 24 hours of filing the support request. From there, Binance will work directly with law enforcement to handle processing of the funds.