Private key protocols for some crypto exchanges have been implemented with bugs that could have been exploited by a well-placed malicious party, researchers say.