If I would experience an exploit, I would report it to the security team of the exchange, because I believe if you do the right thing, you get the same back from life. Plus if it's a big exchange, a lots of money at stake for several users who has the funds there, at the end of the day, it's really about the users, not the exchange itself, especially if it's a payment system exploit.
This is on the other side of things where its just ethical for you to report if you do find out exploits or bugs that would really be resulting a serious effect on them specially if this one
talks about finance the its just right for you to tell and dont expect something back but pretty sure that they would really be giving out some bounty with that
depending on the scope or serious of such exploit or bug.
Well, people does have different minds which means people could decide neither they would abuse it out or would report or do the right way.