"hacked" eh? That's what the MT Gox guy, Mark Kerpeles had claimed too. Both Kerpeles and Bomber are saying "Hey, it's those hackers' fault!" and not them. With both MT Gox and Bitgrail, I'd suspect an inside job.
Bitgrail's actions had been suspicious ever since withdrawals had been suspended. Hindsight is 20/20, true. But customers should have cut loss when they couldn't withdraw XRB - sell it for BTC and withdraw this to their wallet. Even if it's at a loss.
However, many didn't. I didn't have any XRB, nor do I have an account with Bitgrail. However, I did have some interest in XRB and had followed the group at Reddit during the period when Kucoin listed the coin. Apparently many people had held out and refused to sell because of the spread between the higher price at Kucoin (around $16) and Bitgrail ($12). They believed Bomber was trying to force a sale at the lower price, and that he'd pocket the difference. Then came the news about this alleged hack, and clients are left high and dry.
The lesson here: if we can't withdraw any coin or token to our own wallet, then don't buy it. If we already had, sell it for BTC, ETH or whatever and withdraw that. Leaving assets at exchanges - especially the smaller, unproven ones - is too risky.