First of all I'm sorry for your lost.
Well this is strange, it's kinda impossible for the hackers to pass the 2fa unless they got your email or phone. I'm using coinpayment too but I only enabled the email verification and I'm using a dynamic IP so every time I login to the site I have to confirm that I'm the owner of the account, well pretty safe isn't it? This is why I'm scared, storing crypto on exchange.
Actually I have seen a lot of reports by other forum members (who used a phone as a 2FA device) that their accounts were hacked. Usually it goes like that: (1) the phone is hacked and then (2) the user user logs into the exchange effectively compromising both authenticating factors.
Because then the 2FA code is sent to the same device, you see, the hacker at that point has got your both authentiacation factors!