Absolutely. I have worked with Poloniex before and Mr. Tristan sent 0.5 BTC for bug bounty.
But Coinone didn't fixed vulnerability... Passed to a month. Blackhat can hack many user accounts.
I will share the first vulnerability here within 24 hours. People have to get their own security. This is not a disclosure, it is purely good faith.