Everything in the internet is vulnerable.
Have you heard about the recent Twitter hacks that scammed a lot of people recently?
There's no such thing as perfect security as long as you're using something under one's creation or code to be precise.
So for exchanges, regardless of how reputated it is, hacks aren't avoided.
That's why people are advised to not keep their money/fund/capital in an exchange wallet when they're not trading.
It's not your money when you put it in an online wallet because you don't hold the private key, remember that.