If my account is hacked on an exchange, it will depend on the nature of the hack before I can say who should be responsible for it. Let's assume that they got my details through phising, I should be responding for it but if it is large scale hack that affect many, the exchange should be responsible for it