[S3raph]

> How was 2FA bypassed here?

very likely a sim swap attack:

"A SIM swap scam is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message or call placed to a mobile telephone." [1]

[1] https://en.m.wikipedia.org/wiki/SIM_swap_scam

[ksaitor]

This wasn't a SIM swap. When SIM swap happens, you wont be able to receive calls and SMS. I was getting both SMS and calls during the attack.

If someone has a better explanation, that would be great.