This may be somewhat true for some users but I actually had a different PW for my Cryp acct than any other exchange, so this does not apply to me.
I sympathise with you losing your funds, but the whole idea of 2FA is that it proves (at least with high confidence) that you have
physical possession of the sole authentication device and therefore you are likely to be the rightful owner of the account. [2FA isn't perfect, of course. Email 2FA is useless if a hacker already controls your email, and SMS 2FA can be captured by porting your phone number to new account.]
A different password for each site will not help if you have something that has logged your keypresses, or nabbed your browser's password file. Anyone who has a copy of your "virtual" credentials can log in, from anywhere in the world. That's what 2FA is intended to prevent.
I do think you have raised a valid point about failed logins. Multiple attempts should lock out the account, temporarily at first, for a longer period each failure, then eventually semi-permanently. It does sound like you may be making some assumptions about brute forcing, though.
You made some fair points and you're somewhat right about the brute force statement. However, Cryptopia themselves are the ones that notified about the "multiple" attempts. Granted, there is no way for me to know exactly how many "multiple" means, but most certainly in implies more than 3, which should be the floor for beginning of acct locking protocols (as you described above). Since this clearly was either not in place at all or way too easily circumvented by the hackers, which on it's own is more than sufficient grounds for me being due full restitution from Cryptopia.
Although I have now switched over all 6 types security to Google Auth 2FA, this is still insufficient for the trading/withdrawal loophole I mentioned. Cryptopia admitted that the 2FA (PIN at the time) had temporarily thwarted the hackers from just sending all of the LTC they accumulated to an external LTC wallet. But, they used the trading loophole that i described to artificially dump an unknown shyt-coin at 3% its cost (to obviously another acct they owned). So bottom line, if a hacker somehow accesses your account, even their 2FA protocols will not protect from your account be liquidated. This is another huge security gap IMO. Not sure what the bigger, well-respected exchanges has in place to thwart this but there has to be a way.
