It could be a phishing attack targeting their users. I don't see how their software can be compromised unless they were lying about how are the private keys generated and them being non custodial.