Hey.

You should really make it required to authorize any withdrawal by entering their password and/or 2FA on withdrawal.

Just a suggestion.