Hacker News Reader

What's even worse is that the code is used as single factor, eg. No extra security besides this code.

Probably they phished the logins otherwise. Normally those sms are the second factor.