We're a talking private company in the Bahamas that has no oversight. There are no shareholders, board of directors, or audits. Sam can just go to the databases of pooled funds addresses from his admin panel and move some of those funds from A to B. Assuming anyone notices, he can pretend to be clueless. That is the scary thing about exchanges and why so many people in crypto say to self-custody. Your money is in the hands of people who can do whatever they want with it.