Even big sites can be risky. I don't know if you were in the crypto space at the time of Mt Gox.
I recently had a "haircut" from Bitfinex too. They got hacked and I lost just over 1BTC there.
They gave me their own altcoin instead, with the promise that they'd buy it back for the original value when they could afford to. To their credit, they did do this, but by then, I had sold the tokens for about 1/3rd of their value because I didn't believe them.

The lesson is, if you don't have the private key, they're not your coins :)