I am trying to build a crypto payment gateway. But when users initiate a withdrawal to credit their customers, the transaction can be tracked up to the point that shows the system address where the funds are stored. Are there better strategies or services that can help mitigate the issue of users seeing the funds or even trying to hack to address it?
In order to prevent funds from being easily tracked on the blockchain, you could use a Mixer.
Mixers allow users to deposit an amount of tokens, and then withdraw the tokens from another address that is totally unrelated to the depositing address. Doing this essentially breaks the obvious chain of transactions that otherwise would continue to display a specific user's activity.
Some of these Mixers use cryptography concepts, such as zero-knowledge proofs, in order to allow users to prove they deposited x amount of tokens, without revealing the address they used.
An example of a popular Ethereum mixer would be Tornado Cash.
Here is a list of some popular Bitcoin Mixers.
Please note, that while these protocols may allow you to obfuscate a user's transaction chain, every transaction is still completely public on the blockchain by nature.
This means that these techniques are used to make it much harder to figure out which address belongs to whom, but every transaction is still available for anyone to see.
Also, you mentioned not wanting your user's addresses to be "hacked", however the only way for this to happen would be if a user's private keys were compromised, or if the user signed a malicious tx.