There has to be more to the story.

What exchanges are still allowing 2FA with just a phone call?

Also you have that much in an exchange why are you not 48 hr white listing addresses.

Sounds fishy