From this link: https://support.google.com/accounts/answer/180744?hl=en
Keep it simple During sign in, you can tell us not to ask for a code
again on that particular computer. You'll still be covered, because
we'll ask for codes when you or anyone else tries to sign in to your
account from other computers.
Is it possible that you had authorized the computer the transaction was initiated from? This would match the idea that the computer was/is compromised. With a remote control tool an attacker eventually was able to login over this pc and make the transaction through remote control desktop.
If this is true, consider all actions taken on this computer as logged.