So hipoteticly the guy had 2fa on but no pin configured in the app; his user pass was fished on a compromised site and the thief used the app to steal the money; that makes sense?
I think you have to set a pin when making a new account, not sure but its used on the market place for sure and using the app to withdraw with, that said they "might" only ask for the 2fa if your ip address changes much like Blizzard Entertainment does with there own 2fa solution, its only asked for if you format your computer /change your ip address.
Icon