This is probably related to the fact that Authy has two modes — a traditional MFA mode using TOTP (6-digit codes) and another 2FA method using server-pushed sec

This is probably related to the fact that Authy has two modes — a traditional MFA mode using TOTP (6-digit codes) and another 2FA method using server-pushed secrets (used by Gemini, possibly Coinbase and others). The codes are longer than 6-digits, and aren’t encrypted. That’s when a service “enrolls” you in 2FA using Authy. I don’t think they compromised the encrypted / non-Authy-issued codes.