What web server you use? If use nginx, you can try this to secure your wp-admin :

location ~ ^/(wp-login\.php$) {
 root /var/www/wordpress/;
     allow 127.0.0.1;
     allow Your-ip-address;
     allow Your-second-ip-address;
     deny all;

Other way to secure your wp-admin from brute force attacks is to add this lines to your nginx.conf :

Limit Request

limit_req_status 403;
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

And those lines to your nginx virtual host conf:

# Limit access to avoid brute force attack
location = /wp-login.php {
        limit_req zone=one burst=1 nodelay;
        include fastcgi_params;
        fastcgi_pass php;
}

With this setup, the hackers will got 403 forbidden when try to bruteforce.

In your situation, I think the .htaccess setup may be wrong. If you don’t have access to your web server and you use apache, your .htaccess file must be in your wordpress document root.