It's such a 2013 technique, DDOSing exchanges, yet it still seems to work in that exchanges haven't increased their server capacity, plus DDOS protection to ride it out.
Increasing server capacity can be a helpful practice, but if a certain entity wants your site to go down, then it will go down. It just depends on how much resources they can justify to exhaust in order to achieve their goal. If you have been browsing through various deep net markets, you'll know that you can rent a massive DDoS attack for a certain duration. I think as we speak, the major exchanges have a sufficient enough security to prevent any sort of theft from hackers.