Real world banks get robbed every day. As long as the hot wallet is a small enough portion of the total funds (unfortunately not what happened here) it'll just be an occasional cost of doing business.

Real world banks are backed by the federal government, both in terms of the FDIC, and the FBI and broader DOJ. Robbing a bank is a federal offense, and that is frankly why "big heists" tends to be such great fiction. Mostly.

I'm pretty sure that stealing hundreds of thousands of dollars worth of a "thing", regardless of what that "thing" is, is a federal offense thanks to CFAA, if nothing else.

It depends. By design (for plausible deniability) the key is not a password, it's a mathematical fact which can be independently discovered.

If you generated weak keys then it's not theft for me to guess/calculate them and allocate those coins to myself.

This is why BTC is described as proving the strength of hash functions, etc. If it was easy to cheat, someone would claim the public bug bounty by giving themselves all the coins. Because they haven't, we have a fairly good minimum bound on the difficulty.

> If it was easy to cheat, someone would claim the public bug bounty by giving themselves all the coins.

But giving yourself all the coins means demonstrates that the system doesn't work conclusively, and guarantees that no one will accept the coins for goods and services, so while giving yourself "all the coins" destroys a lot of value, it doesn't actually capture any value. So, if you wanted to profit from an exploit you developed, you would not do that (if you wanted to discredit bitcoin and had developed the exploit, you would do that.)

Right, they'd trickle them in to keep it secret. But that doesn't change the bug-bounty nature.

It changes the (paraphrased) "we can tell its secure because no one has visibly compromised for profit it the way they would if they could" nature you suggested uphtread, because, for profit, you would avoid visibly compromising it.

The attempt to rob a bank, even a failed attempt as most are = federal prison. You don't need to steal hundreds of thousands of dollars from a bank for it to become a federal case, which was my original point.

a typical bank robbery is very small (around $3-5k) and the perp usually gets caught. bitcoin robberies tend to be much much bigger and nothing can be done.

So how does Coinbase do it?

Coinbase uses cold storage. They have some reserves in hot storage, but presumably less funds accessable makes them a smaller target. Correct me if I'm wrong, but I believe they are able to pull this off because they aren't technically an exchange. Coinbase Exchange may be all in hot storage, but they provide a seamless way to transmit your exchange reserves to a cold storage backed wallet.

Couldn't find too much information on this, but I see that [https://support.gdax.com/customer/portal/articles/2436336] under "Is GDAX's ether hot wallet insured?" states "The majority of ether and bitcoin deposited to GDAX is held in highly secure cold storage." (GDAX is Coinbase's exchange platform) See also [https://www.coinbase.com/security].