You might have clicked on a phising link a while back and the scammer just waits dormant until you have a large transaction. Why didn't you activate 2FA? It would prevent this kind of stuff. You can even give out your user name and PW, but no one will be able to withdraw unless they have your personal device.
2FA does not work quite that well (at least not all the time). There are always potential ways around 2FA on websites. I would consider it to be reckless if someone is careless about their password simply because 2FA is enabled. 2FA should only be an additional security method, not the only security measure.
Two Factor Authentication (2FA) is the best thing since sliced bread. It almost makes choosing a password trivial, the additional security that you gain almost makes passwords obsolete.