Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled.
edit: correction, beating 2FA without phishing-- like in the post where he lost his account while asleep.
edit: correction, beating 2FA without phishing-- like in the post where he lost his account while asleep.