Maybe there can be just a Smart Contract that yields out crypto currency only when 2 keys match. 1 of them can be scratch code from the card, and one seller ID. The 2 keys basically unlock the wallet of the seller, where crypto associated to the seller is quarantined (the total amount of money he bought in total from the exchange, that is) and he can send any amount to the buyer he wishes (as per the current exchange rate or even giving up his own commission shall he wish).
So, even if the cards are stolen, they have no value till seller code is applied to unlock the wallet (working as a 2FA in this case). And seller sells his own inventory from the exchange and nothing else.... so they would be careful in transactions and cant touch the exchange money.
I can help you setup this smart contract.
2 factor is certainly a good idea