The recent hack of Binance has left many wondering about the security of exchanges. Anti-phishing working group Ciphertrace mentioned that the cause is likely a phishing attack is what triggered the hack. They also mention that 2FA is no longer strong enough and that we should consider 3FA for extra security.
Not really. A form of "3fa" was already in use, which is the authentication code sent by email/sms, in addition to the 2fa code and the password at login. Sure you could add some gadgets to the mix, but you are only going to make life miserable to your users while not necessarily stop the thieves, which are more focused in social engineering and exploiting bad user habits and their poor choice of software.
2fa was never "strong enough", people who though so were deluding themselves. They are only tools that attempt to slow down the thieves. You are not suddenly "safe" by using 2fa, or necessarily unsafe by not using it. If your password is strong and your software and habits are good, a good password will probably suffice.
You cannot, for example use a weak password with the excuse that 2fa is going to save you from using a strong (difficult) one. And now some people looking at the 3fa gadgets are probably thinking the same, well, no.
I think exchanges should use more their imagination. Perhaps look into muiti-sign addresses, for above certain amounts, so that even if the user "withdraws" the exchange will hold it until they can actually get in contact with the user to confirm that was his/her actual intention or not. Kinda like banks do.