White hat hackers discovered that two exchanges had left 1 million private keys for $18 million of customer funds available online.