The addresses of the exchange are known and everyone can see the money that goes in and out. It would be quite difficult to actually steal the money.
They can claim their private key was stolen, and it wasn't the exchange's owner, but we have no way of knowing for certain.