Either its the dictionary attacks or the account user click on phishing links. I have seen a video in which the victim was hacked and he had his Password saved on the desktop of his PC in a txt file name "Coinbase password" xD