I don't know if he really managed to collect such a big amount of money but we can't say it's not possible, since the 2fa key is the same one for login and for withdrawing funds at Stake. 2fa codes change every thirty seconds and are usually accepted during 1 or 2 minutes by websites, so if one phished user enters his 2fa code to try to log into the fake Stake home page, the hacker can steal his code and use it during several dozens of seconds and even minutes to enter into the account victim and to withdraw their funds.
Stunna has answered our question that no funds or KYC were stolen because hacker only managed to get into email not to the place where important data is stored
Regardless of whether the statement can be trusted or not, what is clear is that we still have to anticipate changing the password and activating 2FA is the most appropriate solution at this time. However, this is a warning to stake.com to continue to improve security problems like this are very vulnerable to user trust.