It is the hacker mistake

and his responsibility.
Your mistake because you create an account there and you didn't take enough precaution to protect your account. Your computer or smartphone can be infected by a keylogger or some kind of virus.
The mistake of the exchange because they have security problems.
It can be the mistake of both of you too.
I would think that it's both their fault. The Internet is not free.