Bitcoin wallets shouldn't be accessible from the exchange's code base. When a user wants to transfer funds out there should be a small fee and a human should process it from an secured computer. The verification step should include signing either with a cryptographic key, logging on with a hard to hack account, like gmail, or by sms verification. None of this passport / utility bill bullshit.

It's fucking amateur hour here.