These guys even offer a "2fa" option that is a static password. That's unheard of. This is security snake oil. A static password is something you know, not something you have (like a 2fa token on a phone).

All we're saying to Kraken is: remove bad security options that confuse users. Stop offering fake 2fa. Send email confirmation for withdrawal like every other exchange out there. Enforce 2fa on login, so 2fa on withdrawal can't be disabled without access to the token. These are basic, basic issues that make Kraken look laughable in this space.