The 2 transaction TX were:

6f99b1fe0040443d8dcf2bb1793a26148989f386769c0296645a3171fc32ee4f
48a8c22d0ba6ae103d2e2da068b814e701f73af38c7aa556ab12e0cf27d23e17

The IP from which they connected to the wallet must be known to Electrum! Also how come it didn't ask the hacker 2FA to withdraw?

Please help.