If I would experience an exploit, I would report it to the security team of the exchange, because I believe if you do the right thing, you get the same back from life. Plus if it's a big exchange, a lots of money at stake for several users who has the funds there, at the end of the day, it's really about the users, not the exchange itself, especially if it's a payment system exploit.