Yeah, I read an article not to activate 2fa on bittrex, here is one reason. The hacker can withdraw without email confirmation. I plan to activate 2fa but I cancel after I read the article.

http://highoncoins.com/cryptocurrency-trading-tips/do-not-use-two-factor-authenticatoin-with-bittrex/