[neurotech1]

WordPress VIP that hosts TechCrunch does require 2FA. Not saying it could not have been social engineering, but the usual dumb methods may not work.

[Retr0spectrum]

The most popular method at the moment seems to be SEing phone companies into transferring the account to a phone owned by the attacker, therefore bypassing 2FA.