I was always under the impression that sites like this didn't even store user funds.
Don't know why but, I was thinking they were just using the APIs of other exchanges to make the trades and skimming a small % off the top to make their profit.
There were a few of them in the past that operated that way. Put together a pretty interface, no real KYC, and just take a small cut.
Saw this when I went to do a small swap of some alts I found a paper wallet for when cleaning up and didn't want to be bothered finding an exchange that actually traded them and setting up an account and so on....
-Dave
You might won't believe but local bank in my country was offering crypto exchange service via a child company and the child company was really using an API of other exchanges to make the trades. They fixed it once they became popular.
Btw when I visit fixedfloat.com it redirects to ff.io <-- I bet that they want to make this accident look like they didn't experience any hack at all and all of this happens because they purchased a new domain and want to move whole database on a new one.