Shit happens when you trust someone with your money for such an asset where reverse transaction isn't possible! For bank, it is still somewhat safer because every banking transaction is reversible but that's not the case with bitcoin. Once a transaction is out of your wallet, there's no way to get back unless the receiver sends it back. Also there's no way to know the identity of that person due to the anonymous nature of bitcoin.

In this case, the 2FA got changed using the form available with blockchain wallet owners only! So author's suspicion may be correct - it's an insider job! But if you have learnt the lesson, you will never use a third party wallet ever again!