How does someone actually steal from an exchange?
As I understand most of the funds(80-90+%) are kept in cold storage. Was the exchange not following this "best practice"? Is this not a best practice?
The way the cash equities markets work is you make a trade to buy or sell shares and they get delivered in 3 days time. Why does a bitcoin exchange need to have any bitcoins at all in a wallet accessible to any machine connected to the internet? Could they not work in a manner like this?
Why not net all trades and do settlement at the end of the day. If people want to withdraw bitcoins batch the requests up until the end of the day and then you can have a person or software review all requests before they are put into a hot wallet and sent out.
I've written my fair share of risk systems over the past 15 years. I think I understand how to manage risk, and delaying transaction settlement is considered part of risk management. You can trade as fast as you want but the actual settlement, by design, lags trading to allow for errors to be caught.