It seems to me the freebitco.in backend works as it should but somebody found a way to inject a script on the front-end of the app and it manipulates the DOM and tricks you into doing the shit you shouldn't be doing.

Like: "You are hacked, send x amount of btc to this adress to get unhacked"

In reality, you weren't hacked at all. It is just this script kiddie wants you to believe. Regardless of that, it should be handled asap.