Turn on the authenticator in Account → Security. TOTP secrets are stored encrypted, eight one-time recovery codes are issued on confirmation, and each code works exactly once.
Review Signed-in devices and revoke any session you do not recognise — this includes other browsers, phones and machines.
Use a strong, unique password, never reused from any other site, and never enter your details on a page reached through an unexpected link or attachment.
Never hand anyone your password, seed phrase, client seed or 2FA codes — not to Ruble staff, not to “moderators” in chat, not to anyone.