In addition to the article above. Instead of using Google Authenticate, you can also use Authy! THis works the same but there is a back up for when you lose your phone or whatever!

Second: There is also an option on bittrex that puts on IP whitelisting! So you can only withdraw from that IP adress! The funny thing is, it doesnt recognize mine but i still put it on. So if i want to do something i have to manually clear the Ip whitelisting with Another 2FA code before i can withdraw. It's a bit unlogical but i still do it!

Also, i read that if a website is a phising site it you usually have to fill in your 2FA code twice! it's just unresponsive then.. If this EVER happens. Wait 1 minute. dont fill in another code directly! they use this to enter and then clear other restrictions!

If this happens. wait.! Check your browser for the correct link. Clear your history. Log in again and change password directly!

Hope this keeps you safe(r)