First off, I don't know how hackers get at an entire password table and steal them. I don't know if the owners of the website are to blame or what, but I am wondering if it involves logging into the DB or not.
Assuming that hackers steal passwords by logging into the DB with application or admin users, what about putting passwords into it's own schema with air-tight privs?
PASS.Passwords having the hashed password and UserId primary/foreign key to the User table.
The only permissions any DB user has to PASS schema would be execute procedure. Not even the DB admins would have read privs.
Authenticate by executing IsAuthenticated(@UserId, @HashedPassword) returns bit.
Create password by executing Create(@UserId, @HashedPassword) returns bit.
Update password by executing Update(@UserId, @OldHashedPassword, @NewHashedPassword) returns bit.
And that is all you get. No user having permissions to actually read even the hashed password, would hackers still be able to steal the table even if they compromised the environment?