I’m not familiar with that and if they have a wallet thats different from their exchange app, but the litmus test is:

If you don't have access to your keys then you never owned your digital assets

and if you don't know how to run that test then blaming the victim is completely appropriate here