Op what is the cause of the hack? Is it because you didn't use a solid password or what could be the issues over here. Most time people hacking your account are those closer to you that is why you must learn to have a complicated and mix password where it would be too for someone to memorize it except you.. you are really lucky to had have this immediate attention sometimes most of the hack account ends up taking loan on the forum without the real owner's knowledge when it's restored back you start paying loans you didn't know about.
He answered a similar question in another thread through he is not sure how his login details got exposed or leaked, but here is what he said;
sorry that I am not replying please try to understand
looks like only my Bitcointalk account was hacked, nothing more
my only guess they brute-forced my Bitcointalk password or it leaked somehow and when it comes to that on my end only thing that comes to my mind is:
I downloaded some malicious file exactly 1 day before it happened on laptop that I use when traveling, so nothing important on it, at least I thought so, I missed that there was brave browser synced to my other devices and I haven't unsynced it (big mistake)
If this is true then like this they could bruteforce my password manager password and get aces to Bitcointalk password and account
but if this is true why haven't they also removed email on my Protonmail from Bitcointalk, I was able to suspend that account
only explanation that they where not able to hack brave password manager so logged to my account using synced Brave browser and then changed the password as there was no 2FA (another big mistake i don't know how I missed that)
also I have seen attempts to login to few of my accounts that I haven't initiated lately, still it wasn't successful and i was able to change passwords and add 2FA to them
so is hard to tell what happened exactly
Perhaps it's one of the reasons why are taking long to recover the account but I am positive he will be helped.There is another account that has been queued for ownership change.