Sure Cryptopia must have had a terrible security, they take forever to even do a simple fork (for example over a month for ARK, one the few top 50 coins they've listed which is forking less than once every year for big updates). I didn't expect them to have top-notch security systems and procedures.
I don't think the hacker has stolen small-cap altcoins, their price would crush on the news of the hack and the hacker would have gone through the trouble for nothing... that is if Cryptopia was transparent enough to announce the name of the hacked blockchain.
Right now we can only guess, and it seems only Ethereum's wallet and its shit-tokens have been stolen. Could it be thanks to FPGAs/ASICs in combination with the reduced interest from individual miners?
I was afraid that the attack on ETC was a test to prepare for a hack to ETH, maybe the hack to Cryptopia is related.