The token sale site for startups has confirmed the overnight hack, which saw some user accounts drained.