They use normal 1... bitcoin addresses right? Then how can it be possible that its impossible for them to know the private keys? The wallets are on their servers, which means one way or another they, or at least an employee has to be able to get the keys.

Maybe i did not think it through how it could be done otherwise.