My coins are still in my purse wallet. No 2fa on there. I do have 2fa on my email tho.
It could be possible that the coins are still under Purse's control in that they had the accounts set up in multi-sig so the money could not be transferred off-site, only to another wallet under their control. Until we know more we can't say either way what the status of those 'hacked' coins are.
So they received a withdrawal request, then moved the coins to a wallet they control and sent a notification that the withdrawal was successful? On what planet does that come close to making sense?