On a serious note, am I right to tell this guy that it's not up to Just-Dice to refund his coins? He seems pretty insistent that it's the site's fault the coins were stolen.
You have no duty to provide a refund.
It is his fault for losing his property in the first place. While it is unfortunate- you have no responsibilities regarding the situation.
Agreed ^. It does highlight the 'weak link' of 2FA: your phone. Not a place to store passwords, and not good to login to services with 2FA on the same phone as authenticator app, as login may persist for a period.