Binance account hacked through API

A few weeks ago my Binance account was hacked through an API I set up with Koinly about a year ago. When I created the API trade access was ticked by default so I never noticed Koinly had trade and read access.

Someone stole my API key and secret they used a bot to buy and sell bnb pairings which drained my account over hundreds of transaction. Thankfully it wasn't my entire portfolio but it was a decent amount.

My question is how could this have happened?

• I don't believe I could have been phished as they'd still need to enter my authenticator and email code.
• A friend didn't have access, I never stored the codes anywhere.
• Could it be a key logger that had the details since last year and just activated it now?
• The Binance or Koinly platforms were compromised somehow?

I'm really surprised Binance doesnt have any safe measures in place to halt trading on an account that has suspicious activity, I'd never used a bot before so you'd think there would be some type of safe measure in place to stop this.