Exactly, if you hold crypto in an exchange, *they* hold the crypto and you just have a promise (IOU) that they will pay you back when you want it. Until something like this happens.