First employee of a major exchange here. You were correct a few years ago, but it's not strictly true anymore. Some oversight and accountability comes from the VCs that own them and sit on the boards, some from the compliance requirements of banks they work with to obtain financial connectivity, and some from people they outsource customer onboarding to or work with for additional financial settlement options. Also, third party penetration testing should be common by now. There is also something to be said for "zero legacy infrastructure", from a security perspective.

I'm still waiting for an exchange taking proof of reserves or multi-sig with other exchanges seriously.

We know it can be done, and we k ow that none of the exchanges do it anymore.

As hopeful as I am, I know that scaling number of users is much more important for exchanges than advancing security through cryptography that users can verify.

At BitMEX we do 100% offline multi-sig. Unfortunately, that also means any form of live proof-of-reserves is quite difficult to do, as the keys are offline.

Early in our history, we thought once-a-day withdrawal would be a problem customers would be quite vocal about. Instead, we found many of them appreciate what it means - that the keys aren't hooked up to a hackable webserver, but are actually protected. Accessing funds should be difficult and should require human interaction.

Pardon me for sounding ignorant, but how does this process work out procedurally each day?

All crypto on Coinbase is insured, according to:

https://support.coinbase.com/customer/portal/articles/166237...

This counts for a lot IMO. Of course there are still questions of whether and how the insurance comes through. But it's a big step to make such a declaration, and the implications on security are significant.

When they say stored 'online' they mean 'not in cold storage'. 98% (according to that article) of the crypto held by Coinbase is in cold storage and is not insured.

I wonder how many people make this exact mistake.

Which makes sense. I imagine insuring cryptocurrencies is very, very expensive, considering the risk profile.

Good point. The cold storage procedure is also impressive, but not as impressive as full insurance.

Bitcoin.de has a cooperation with Fidor, which is a regular bank in Germany.

When trading on their platform you always trade directly with one other customer. The funds are transfered directly from your Fidor bank account.

Of course, the BTC/BCH will still be on the marketplace until you remove them.

Common wisdom these days is: The only safe place for crypto coins are paper wallets (and, arguably, hardware wallets).

When looking at HSBC, corrupt rating agencies, Equifax etc, may I ask what the "real" banking sector has learned?

I honestly find this attitude fascinating. A Technology that exists since- 5 years, and yet, expertise is demanded, as if these exchanges could attract and hire the experts of banks.

The thing is, all the "new" or "high tech" parts of bitcoin can be treated as a black box, and their relevant properties summarised on a single sheet of paper. You could then hire someone with financial controls expertise to run the other side of the business - the entirely conventional money handling.

A bitcoin exchange really isn't all that different from a metals exchange, if you substitute "physical delivery of gold" for "emit an actual on chain bitcoin transaction".

Other fintech startups have little difficulty in attracting experienced talent. You see a lot of grey hair and a lot of very distinguished CVs in that scene. Several banks run their own accelerators and angel schemes.

If cryptocoin startups can't recruit the right talent, then I think that's a strong indicator of their fundamental business value.

"Dunning-Krugerrands."

this is gold