Sign transaction offline.
Move txn to online system.
Broadcast it.

That's what I've been doing for years or if it's small amounts Google Authenticator 2FA, just avoid all SMS/phone number 2FA schemes, that is easy to fake and how businesses get their domains hijacked routinely when some guy spoofs their SMS recovery and logs into their gmail, then changes their domain (or in OP's case, steals all the coins).