This shit is real! A good mate of mine just lost 5BTC even though he had f2a activated. He was logged in to bittrex on another computer and saw the hackers sell his coins for BTC, he managed to cancel the withdrawals 5 times whilst he was simultaneously getting his wallet address ready to withdraw the funds himself.
The hackers then sold the BTC to ETH and when he tried to cancel this withdrawal he got a message saying that he was unable to cancel the request.
A ticket has been opened to Bittrex for what that's worth.
Be careful guys.