hack – Incentives for a centralized exchange to claim it was hacked?

I think most of the hacking incidents in which lot of bitcoin were involved being moved from the cold storage addresses of exchanges are insider job. Especially few Indian Bitcoin Exchanges.

However, I am not sure what all incentives are involved in doing so if they are still working or did refunds for users before shutdown.

Bitfinex issued some tokens, Coinsecure did refunds in fiat using old exchange rate, Cashaa is still working, Binance still working and did the refund etc.