In that case they should have required users to also login to bitgo and approve any withdrawals. Otherwise, what's the point of Bitgo?