It almost always starts with a phishing attempt to get the original password. These attacks are unfortunately common for those working with cryptocurrency.