So, a little anecdote, a friend of mine was the victim of an attack and wanted my advice. The attackers used the SS7 hack, but he also used a phone based TFA,

So, a little anecdote, a friend of mine was the victim of an attack and wanted my advice. The attackers used the SS7 hack, but he also used a phone based TFA, and somehow attackers were able to get the keys to this. He was able to get some of his coins elsewhere on a paper wallet, but they got everything in his hot wallet, and he received a notification that his coins were being moved out of his cold storage. Thankfully this process takes some time, so he was able to get that company on the line and stop it (probably pure luck that the attackers didn't intercept this). I told him to lock down the cold storage and trash his phone (based on the level of control that would be required to get TFA private keys). So, there hasn't been any further analysis done on this attack (the cold storage coins are safe, that's the main thing), but just want to mention this to get your gears turning. It's possible coins being stolen this way are being used to fund a nuclear program - keep them close.