What else can the exchanges do? The most recent blocks show that the attacker is still minting away, see the 100 XZC transactions:
https://chainz.cryptoid.info/xzc/block.dws?21758.htmhttps://chainz.cryptoid.info/xzc/block.dws?21749.htmThe transaction is a Zcoin Spend which moves money from the private pool to the public pool. The attacker's fraudulent Zcoin Spend transactions are being accepted as valid by nodes when instead they (and the block) should be rejected as invalid.
I don't think the bug is due to a simple typo. I believe it's somewhere in the implementation of the verification code, which looks like its full of repeated blocks of copy and paste code. Posted more info here:
https://makebitcoingreatagain.wordpress.com/2017/02/18/is-the-zcoin-bug-in-checktransaction/In terms of resolution, the following would be prudent:
To demonstrate that the bug has been fixed, all the fraudulent Zcoin Spend transactions found on the blockchain should be run through a patched CheckTransaction and detected as invalid.