Kucoin Hacked Account - Can you Help to know how do it?

Hi,

It is a story of my hacked kucoin account.
It was march 25 of 2018, in the night.

I was going to sleep, before that, I check my account in Kucoin (I like so much the cryptos). I do it, in the cell phone, with the Kucoin Andriod App. And strange message show me.

I try to continue, but I couldn't do, I tried again but the same message show. I thought that an error in server and I went to sleep.
Next day, I get up, I take my phone and surprised, two mail unread in my inbox. I check its. A withdraw to confirm and withdraw success.

What 's Fuck ! There was the amount of my account. I try to enter to kucoin, but the 2 factor security (2FA) all time is wrong. I enter to the e-mail and I check the account of transaction. The worse notice, it had the BTC in the hacker account.

I try to contact the online support of Kucoin, never responde. And they redirect to submit ticket to support.

I changed all password. I am very scared. I was hacked. I need to enter to my account !!!!

I didn't know what can I do now?
I submit several ticket because my 2FA are wrong all time and for the withdraw that I didn't do.

I only just can wait.

I did enter to event security of Gmail, and I see the activity.

An iPhone login (do not use iPhone) and do a google verification with Kucoin. WTF !!!

I had active 2 factor security on my phone. I only use kucoin in 2 PCs and 1 cell phone.
A day later, I'm looking for security events. I saw that when I use the PC, the iPhone (the pirated phone) is synchronized with my Gmail account, I automatically unplug it, change the password again on another device, delete the fucking Windows 10 (with antivirus actived and cleaner 1 mon) and put Linux.

From this moment, I checked all days and I do not have any strange connection or synchronization.
And they were a withdrawal from BTC to this account.

3 days later, kucoin response to unbind the 2fa security, they unbind, I enter to my account and all my funds are lose.
They sell all my alcoins to BTC.
! [kucointradehistory.png] ()
! [kucointradehist2.png] ()

They did do a withdraw of BTC to this account.
https://blockchain.info/address/3Dpmce9UVnCRMigxDsC9ajzRXjcwxjBWUz

I checked the login history of kucoin and I saw it.

All of my connections was with IP of Argentina, and only 2 with IP Turkey and France and they never check it.

10 days later, I try to loggin of Kucoin and it show a message.

And a new security Questions added.

Recently when I enter to Kucoin. They cannot continue if you do not complete the security question.

Conclusion:
I am be sure that I wasn't enter the pishing page, but my computer could have a virus or something like that. The Google 2FA security is in my phone and it was clean.
If they can steal my e-mail credential, and one 2FA (in the morning when I use the PC)

1. They can enter to login with the 2FA, at the nigth? There are 3 different connections.
2. If the 2FA code changes all the time. You want unbind 2FA security, you need re enter the 2FA.
3. If you like do a withdraw, you need re enter 2FA.

How could they did it?
Can you help to resolve my doubt?

PD. Sorry for my english, It is bad.