My working theory is that the attackers hacked polo, got a list of non 2fa, then went manually through them alphabetical.
The hacker has been able to do this for atleast a month and a half.
The hacker drained my account nearly exactly like yours by setting counter trades.
Yes polo should be able to track this, have they made any effort to call in authorities? I doubt it.
Hence, I believe they should be opened to a lawsuit.
No, they have not made any effort or gotten back to me yet, I have been constatnly sending them emails, and raised a ticked 4 days ago!