So you had $40K in your account and you didn't even set up 2FA?

Without 2FA there are so many ways an attacker can obtain your password.