Possible Binance Security Flaw

Starting October 22nd I've started receiving multiple "Login Attempted" emails from Binance (I checked and it was not phishing but legitimate emails from binance's whitelisted emails). I then disabled my account immediately and contacted support directly from the Binance site. I was told nothing suspicious was found and these might be from me changing networks or using VPNs. This was not the case as I do not use VPNs so only local IPs should show up and these were from different countries (Germany, Spain, Czech Republic...etc). Whoever is accessing my account might be using a VPN but not me.

After unlocking my account, I logged in and took a look at the authorized devices and I found two random G011A devices which is a Pixel 2 Phone from 2017 which I've also never owned. I removed them and I then proceeded to change my 2FA key and I received another login attempt email this morning and it was in my list of authorized devices again.

I have 2FA and email authorization enabled but I never received an email for authentication for these logins as I normally would, but merely a new IP Login Attempted and the same exact device in my authorized list of devices. I have gone ahead and also changed my password.

Nothing has been withdrawn yet as everything was locked in staking and now with changing my password and 2FA withdrawals are limited for a small period.

Yes I know I shouldn't keep anything on an exchange (most of my assets are in my personal wallet).

I've also checked the list of devices authorized to access my email and nothing suspicious is there.

Overall, one of few things might be true:

- I'm fully compromised

- Binance has a security flaw that allows bypassing all authentication

- The Pixel 2 Phone 2017 has a security flaw that allows access to Binance without authentication

- The dev team is pushing wrong emails to me