All our staff left 11:20 pm 

but there was transection around 12:22am and when we checked CCTV no one is there .. but there is sales and refund by one of tablet .. 

is it someone hacking the system ? Or it just system issue ?  

Hello. 
First of all, we recommend using Employee management and give each employee its separate access. It will allow you to see exactly who is making such a receipt and refund. Employee management will also allow to manage of access rights for each employee group. 
The Loyverse POS app takes the time from the device settings. And if the time on the device was changed, you will get the time stamp on the receipts with this time that is set on the device.