Presently, Bittrex and Poloniex do not appear to be using any cold storage of their Steem account funds. As of now these are the balances of their accounts: 
Security Now
While I have confidence that both of these exchanges take security very seriously, it is a bad idea to have this much liquid currency on online accounts continuously using the active key to sign transactions. I have so far been aware of their lack of cold storage but I figured they'd work it out in time. Bitfinex reminds us that now is the time, always, for security. If either of these accounts were compromised there would likely be a hardfork to fix the damage (re: Draft Steem Constitution) but that would get messy and there would still be significant losses.
As stakeholders in Steem, we must ask these exchanges to use better security practices for the value of our own accounts and the network as a whole.