Yes the flaw was C-CEX's, but let's not forget that ultimate liability lies with the person who took advantage of it.  C-CEX is as much a victim as anyone else in this situation.  Yeah it sucks, but that's the way any legal system would see it.  If your car is stolen because you left the key in it, you made a stupid mistake, but you are not responsible for the loss - the theif is.  Any forex broker would reverse the transactions without question and you'd just have to suck it up.