It is entirely possible. Being a marketplace their software sends coins around for all sorts of reason, this is what was hacked. Someone's personal bit coins are not at risk.