Yeah, but it's hard to say whether the transaction to the new address was done by a fraudster or the exchange.

They can claim their private key was stolen, and it wasn't the exchange's owner, but we have no way of knowing for certain.