I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
If you presently pay for domains with companies which do not offer two-step authentication, this is something you need to bring to their attention - it's obviously going to take more than the small incidence (extremely deleterious to those it happens to) of failure on the part of those entrusted with authentication details or administration to get big companies to implement this level of security.
One company which does appear to offer domain registration with the option to enforce two-step verification for accounts is Google - related reading:
How to enable two-step verification (intended for domain services administered through Google Apps; also helps if you register the domain administrator's e-mail address with Gmail)