Most likely Binance, but would not be shocked in the least to discover negligence across US based CEXs. They know a majority are not going to want to hold in cold storage, so no real fear of a run of withdrawals to cold storage.