There is bugger all one can do about DDoS, really, without a huge investment in DDoS mitigation services (the "free tier" of CloudFlare probably won't cut it for an exchange...). Launching a DDoS attack is cheap for attackers, whereas mitigating or defending against them is hard.