Finally got an answer from their support (3 days after I messaged them frantically). They claim someone else must have had my password and PIN number, and said the transaction was done from a certain IP address. I checked the IP and it's a TOR exit node.
I replied that it's impossible my password has been compromised, as I used a very long and random password, have a lot of technical experience and take great good care of my computer so I'm sure it's not infected with any info-stealing/keylogging malware. I also raised the possibility their side has been compromised. Only 2 days later I got a message back saying they will look into it, and that I'm the only person who reported something like this.

Have you tried contacting their support already?

Never used them. But the fact that the bitcoins were moved to another address might mean that they moved it to a cold wallet: a different wallet to insure they are not easily withdraw. Important is to check if your balance is still the same. Anyway, message them again.