If bitcoin is going to be on a custodial exchange they should at the very least give you your xpub as proof of reserves and not reuse the same UTXO for receiving.