what kind of plugin you use? did you usually also use your api to withdraw money? as far as i know withdrawal via api was never recommended, if you plan on continuing your business maybe change that too. going through some small troubles to ensure your funds safe is always worth it.
yes we have a local exchange website and we used their api for withdrawing automatically to our customer's wallet, but hackers could access to our server and then send a request to our API and as result, it sent a request to the binance, in this case, Binance detected that this ip is allowed in the account but they didn't know that yes ip is allowed but the request is not allowed,I think they could implement kind of account tracking in their system so based on your account history they could find that this request with this amount is not usual so lets al least get an email confirmation for the account owner.