I read about the same situation and what stood out to me was the discussion around how certain platform actions appeared to rely on checks happening in the browser instead of strictly on the backend servers. Security professionals usually warn against that design because browsers can be manipulated using developer tools or modified requests. If a system trusts that input too much it might allow unintended behavior. That said, a lot of early stage platforms sometimes launch quickly and then tighten their systems after researchers start testing things publicly. It does not necessarily mean something bad happened, but it does highlight how important independent security reviews are. I would be interested to know whether the exchange acknowledged the findings or pushed updates after the concerns were raised.
View attachment 1452
Another angle worth thinking about is how many users actually understand the difference between theoretical vulnerability and confirmed misuse. Many technical writeups focus on what could happen under certain conditions. That is different from evidence that it actually occurred. With DX Exchange the conversation seems to revolve around possibility rather than documented incidents. Still, when security analysts start talking about easy manipulation of requests or account related processes, that tends to make people uneasy. Exchanges hold financial assets so expectations around system integrity are naturally higher.