I'm not saying this is what happened but the API doesn't need Two Step verification once it is enabled. It also appears that Withdrawal Whitelist wasn't used and could have been an option to use during the video. I'm sorry to hear of the loss. Please reach out to me as I'm happy to help assist with your cyber security.