hackers user rainbow tables. they calculate passphrase for millions of accounts. maybe they already knew the password to your account even before you have created it. then they check all the known accounts for balances. if there is enough on it they take it.
it also happened to me in the beginning

but to be honest it was a really weak password with just 9 characters/numbers