Security flaw on HitBTC

I helped my friend with getting into crypto. He bought 1 ETH via fiat bank transfer and moved it to his wallet on HitBTC. He waited for a good Ethereum and Envion price for a couple days.

In the meantime someone accessed his HitBTC account and transfered the Ethereum to the trading account. At this point all trace of the Ethereum is gone, except some dust of approximately 0.017 ETH.

Today we accessed his account and realized that something is fishy, we started to investigate.

Point No. 1

The Ethereum arrived to the HitBTC wallet with no problems.
The next day Ethereum is moved from the main account to the trading account by the hacker.

Point No. 2

Someone from a Russian IP address accessed his account after only one missed login attempt. My friends google authenticator didn't trigger any alarms, his email is in tact.

Point No. 3

At the end, we found out that this weird sale pattern happened.

Buy high - sell low on the NEU/ETH market.
He obviously sold the ethereum to him self with a bot to avoid the withdrawal confirmation email that is usually issued by HitBTC. We contacted HitBTC about the issue and still wait for the reply.

So please be aware of this withdrawal avoiding method, really smart I must admit, we never saw it coming. We didn't setup the 2FA on HitBTC because my friend just wanted to buy some cheap Envion and send it to a paper wallet. We doubt its hacked via a keylogger because then they would have his google account also.

Any white hat hackers here to tell me how they could have done it?