He enabled two-factor authentication yet clicked a phishing-sMS link. Hackers bypassed security, logged into his account, and withdrew all coins. The exchange could not recover funds, so he bore all losses.