i had 2FA enaled but got a email that is disabled. And now dumped my XST coins and pay out the BTC
Don't use email 2FA or SMS 2FA where the text is sent to google voice, especially if you are using gmail as your account login.
Probably what happened is that you use a weak gmail password or it got sniped through malware or shitware vulnerability (e.g. teamviewer) and you also had 2FA linked to the same gmail account through google voice SMS 2FA or email 2FA.