So you've got to draw a distinction there, though the distinction was blurred significantly by the repeal of the Glass-Steagall act.
Particularly before it was repealed, you had two different kinds of banks: Savings and Loans, and investment banks. S&Ls were the ones actually making the loans, and would have been prohibited from getting involved with CDOs. Investment banks would have been allowed to get involved with the derivatives market, but could not have operated as a S&L.
The banks who were just operating as S&Ls made out like bandits - they made bad loans, immediately found a rube to sell them to, and whistled Dixie as they walked away.
Banks that bought a lot of these CDOs ended up being the rubes, and that activity was the major source of the "too big to fail"-type bank closures and near-closures.
Where it gets muddy is that it used to be illegal for those two kinds of banks to be the same entity. But still, I think you can draw a logical, if not physical, line down the middle in order to say, "the people actually making the bad loans weren't really the victims here."