Yes, it was very simple, just enter a new address and confirm it with a confirmation mail... (maybe there are additional security settings you can activate, I don't know.. but of course you have to be logged in, and login is protected be yubikey here)
There is the "global settings lock", but I don't think it would have helped in your case as you changed the email yourself.
Protip: Use an email provider that offers 2FA as well.
Yes... that's why I chose mailbox.org... they offer a yubikey for 2FA. But you can't use the yubikeys you have already and have to buy a new one. The yubikey for mailbox.org will arrive in ~ one week. ... ... ...
But I used a very strong password of course. So I can't imagine someone hacked it via brute forece or something like that. And there are these issues with the website described above... so my system/WLAN could be compromised (it's very new system on a new laptop, just a week old)... we will see..
I assume somebody only has access to my mailbox account and changed the password via password resett (is this possible with just have access to mail account? )
But because he needs the yubikey to withdraw bitcoins/login, he can't do more.
I also have normal access to Kraken at the moment.
What sort of security do you use on your wifi? WPA2 + AES?
Why Yubikeys? They do fail eventually (I'll admit after millions of taps ) . I prefer Google Authenticator as I can transfer it to another phone. And if you don't trust Google on this there are other implementations.
You get what you pay for. I realise you pay for both one way or the other, but if you want support 24/7 it will cost you a lot more.
For mailbox.org there is this:
c/o Heinlein Support GmbH
Schwedter Str. 8/9 b
10119 Berlin
http://www1.dastelefonbuch.de/?kw=Heinlein+Support+GmbH&ort=Berlin&pu=1&s=a10000&cmd=search&ort_ok=1&vert_ok=0&ciid=&rgid=&kgs=&district=&ciquarter=&pcZVO=&cx=195195&cy=172506&lat=52.516199&lon=13.376781&radius=&sp=0&aktion=23&ckrid=c3336