The exchange says private keys were not stolen, a bitcoin-backed protection fund covers the loss, and withdrawals stay frozen while it investigates.