people still get hacked even with two factor authentification. I think Poloniex and Kracken are fine. Poloniex has more options
I think people can't withdraw cryptos when they hack your account, but they can buy/sell, so they set up a buy order out of the money on a sparse crypto, then with the hacked account they fill that order, so their personal account gets the money.
For me I just had NEO, so I'm getting a NEO wallet.
Is it easy to transfer?