Happened to a friend of mine as well this year. There are all the stages when you are digitally violated like this. I think we almost narrowed it down to a mobile phone social engineering hack (claim to need a new sim card for someone else, get it in a phone, have the exchange send the 2fa message, scooooop)
Absolutely sucks for Bel as he has been an awesome blockchain citizen since before this was a fork. He will bounce back and I hope for some amazing luck to make up for this unfortunate setback.
Yeah I don't trust text message 2fa I feel like everyone should just be using an authentication app that can't be hacked so easily.