The heartbleed bug existed in the wild for months before it was made public.
It has been in the code for roughly two years. The point to all of this is why CryptoAve? If one has knowledge of this flaw, why would one attack a brand new exchange with few users and no potential to profit for doing so?
If you look back to the first weeks of March there were a lot of different sites being hacked every other day.
Gox had gone and I suspect they were coming for the leftovers.