[...]
Any exchange that does not have 2FA should be avoided.
[...]
Some email service providers also give options for 2FA which will be required if you want to login in from a new device.
It's extremely rare for a modern centralized crypto exchange to not offer layered security features like 2FA. Also, as you mentioned, even when the exchange is not providing 2FA, we can provide our email account with an extra layer of security. OTP verification, 2FA, or even a physical hardware security device like YubiKey. It's strange if there's someone who doesn't take it seriously to secure their email account, especially when that account is correlated to money.
[...]
[1] They gain access to your email
[2] They search which crypto exchanges you are using
[3] Hide security emails using inbox rules
[4] Reset your exchange password
[5] If successful, they gain access to the account
[...]
Maybe how the hackers gain access to the exchange is not as simple as this. Some people are just too careless to store important stuff like 2FA backup/recovery codes, private keys, or other important information in their drafts. Sometimes, they also send an email about it to themselves. I think this is also significant in making it possible for hackers to gain access easily to an exchange account that is correlated to the email account. Another potential scenario, the 2FA is linked to the email account, so the 2FA can be duplicated by using that email account on another device. Or maybe there's also social engineering involved based on all the information they gather from the email.It's extremely rare for a modern centralized crypto exchange to not offer layered security features like 2FA. Also, as you mentioned, even when the exchange is not providing 2FA, we can provide our email account with an extra layer of security. OTP verification, 2FA, or even a physical hardware security device like YubiKey. It's strange if there's someone who doesn't take it seriously to secure their email account, especially when that account is correlated to money.
