In my opinion, as an investor who encounters the theft of an exchange, it is the investor himself who suffers in the end. The exchange will not be responsible for such things and will not compensate investors for their losses.
they will refund only if its thier fault like what happen on binance before where they refunded their costumers but if its the users fault on why they lost thier coins , that wont be the responsible of the exchange . before we step in , in the exchange we already know that its risky because anytime the exchange can collapse so we shouldnt get shocked with the consequences that might happen . to the question if how they treat stolen money ? nothing . what can they do once the money is already stolen ? and they are aware with it once hacking had happen .