they retain private keys that unlock proxy tokens on binance's private blockchain. we're going from DEX trading with eg ethereum's POW security to a private federated or DPOS blockchain. when CZ did an AMA recently, he confirmed there will be 11 validator nodes securing binance chain. lol!!! that's a huge step backwards. it's more centralized than ripple!
when you look at what bitshares and ethereum have already done, and what blocknet and komodo are building......what binance is doing is the most centralized attempt at a DEX yet. (that is, until okex releases theirs lol)