If it’s open-source, can anybody hack Circles and take my tokens?

No. The transactions are embedded very deep in the blockchain. This is probably the most secure way in the world today for storing information: where are which tokens and to whom they belong.

The only risk is losing your secret 24 Magic Words. If you lose this phrase or accidentally share it, you may lose access to your Circles. So make sure to keep it safe! Here are our suggestions on that.