This has nothing to do with 2FA. It was a bug on LNbank that allowed hackers to make payments from the LN node.