Somebody, one of these days, should design a cryptocurrency whose point is just to NOT get stolen.
It's possible to have customer balances of $60 million and not lose them. Thousands of businesses manage this. They suffer $5+ million dollars of damages in less than 0.1% of business-years. (SWAG on a reasonable upper bound-- ask an actuary. This is an insurable risk.) Bitcoin exchanges with this level of deposits sustain $5+ million dollars of damages 20%+ of exchange-years.
Running Bitcoin exchange probably requires $10 million a year in engineering and compliance costs, and consequential changes to the business model with an eye towards a) paying for the actual costs of running the business and b) compromising on other things that users/investors care about, like speed of withdraw, degree of engagement with the regulatory state, and growth rate. Instead of making that tradeoff, Bitcoin businesses continue trying to grow at 100%+ YOY on four, five, or six digit risk budgets. And this works... until it doesn't.
"How do we not transfer substantially all of our assets to fraudsters?" would be an acceptable job interview question at the Medici bank in the early 15th century. It was a solved problem then.
that's true with US cash too. the problem with some of these exchanges is that they essentially have these buildings with $50M+ cash sitting inside them, but they are NOT also running bank vault level security, quality-wise, to protect that stash. some are better than others, but it makes sense that the worst of them will be run by underqualified people.
I've had the opportunity to look/study behind the scenes at a few major Bitcoin websites, early on, and... let's just say you never wanted to learn how the sausage in the sausage factory gets made. "This PHP kinda works on my box... Let's ship!"
http://finance.yahoo.com/news/hackers-steal--100-million-fro...
So, people should trust or build on existing system if they care about their stuff disappearing or being stolen. There's mitigations that work for that situation for the common case. Unlike Bitcoin and its exchanges.
Of course, understanding the difference between an exchange and a bank is worthwhile - but these guys getting rinsed repeatedly and taking out user wallets is a problem that can't be waved away.
> Running Bitcoin exchange probably requires $10 million a year in engineering and compliance costs
Well, that looks like it's much cheaper to just wing it and take the damages. So that's what the free market will do.
The same scheme can be implemented as a one-page smart contract on Ethereum: http://www.blunderingcode.com/ether-vaults/
Of course Ethereum had its own giant theft, but that was from a convoluted, poorly-written, and much larger contract. There are ways to avoid the sorts of vulnerabilities that were exploited there: http://www.blunderingcode.com/writing-secure-solidity/
Probably other vulnerabilities will be discovered. But I think simple contracts that secure ether with multiple keys, timelocking, and so on are a pretty good solution for anyone just storing and sending ether. They're also starting to incorporate formal verification of contracts; the online Solidity compiler includes it now, though it doesn't yet support all Solidity features.
By forcing Bitcoin into a central clearing house model like most of these exchanges are doing you arguably have the worst security properties of both models.