I'm guessing any withdrawal that was done while using an exploit to bypass 2FA could be called unauthorized in this case