No exchange is 100% secure even if claimed by exchanges. Once you withdraw your coins to an exchange, the coins no more belong to you because you no more hold the private keys. So, it is always better to just trade them ASAP and withdraw to your local wallet if you can and if transaction cost allows.
This is the true correct life lesson that we must practice, I also have some XCA still stuck in topia and at this rate probably xcash is the last to get activated for trading. I also expect minor dump as people try to liquidate their XCA via topia due to No Withdrawal issues.