nitrogensports only has google 2fa. so if phone hacked. they can get codes.
But did you have that option enabled or not? I couldn't find an answer in the thread.
they told me oh well too late 20 minutes after it happened
This means the transaction has already been processed. That's really fast, maybe they could at least provide you with the hacker's IP...