If there was some secure way to do password recovery that was built into the currency that might be a game changer. That might be impossible by definition, not sure.

When sending coins to your storage address, you'd say "anyone can use this money if they have this private key OR if they get a digitally-signed certificate from 3 out of 4 of these keys (A, B, C, D)". Those keys could belong to different institutions (or persons) that would declare they vouch for your identity.

Then if you lost your key, you'd go to each of them to get your certificate signed and could then use the coins again.

--

Of course, this means that if those institutions colluded, or all got hacked, you could still lose your coins, but it'd be harder than just keeping them in an exchange.

Instead of doing what you suggested, normally it's 2 of 3 where it's your cold wallet, your hot wallet, and the online wallet provider.

Shamir's secret sharing algorithm can be applied over many groups other than GF(2^N). In particular, you can generate a polynomial of degree N where F(0) is your ECDSA private key, and for 1 < x < M, tell trusted party number x that they're party x and F(x) = y. Cooperation/collusion among any N of the M parties is sufficient to reconstruct the polynomial and calculate F(0). However, N-1 collaborators learn nothing about F(0), as long as you've generated all of your coefficients randomly and uniformly over the size of the subgroup generated by your elliptic curve's generator.

You can even have N parties each generate their own secret random polynomial f of degree N, and publicly share f(0)*G and privately share f(x) with party x. You add up all of the publicly shared elliptic curve points to get a public key for which no one party knows the secret key. Each party remembers the sum of the f(x) secrets they've been told. For polynomials, f(x) + g(x) + h(x) = (g+g+h)(x), so any N of the participants can collaborate to calculate the previously unknown polynomial for which f(0) is the private key. You need to first share Pedersen commitments of the public f(0)G values, perform a sanity check on those, and then reveal the f(0)G values and perform some more sanity checks in order to rule out cheating. See https://duckduckgo.com/?q=gennaro+distributed+key+generation

Once you have your public key for which nobody knows the private key, you can perform the same procedure to generate the random R value of the (R,S) pair of a Schnorr signature. Each party can then perform a Schnorr signature on H using their secret share of R and their secret share of the public key. They each reveal their signatures, and any N of those signatures can be used to reconstruct a polynomial where F(0) is the S value in the (R,S) signature on H. At the end, all of the sub-signatures and the final signature can be made public without anyone learning anything about the secret values. This is called a threshold signature scheme. (There are other threshold signature schemes. I had to implement threshold RSA in Rivest's 6.857 class.)

Unfortunately, ECDSA isn't a Schnorr signature scheme, but Ed25519 is. Any coin built using Schnorr signatures for wallets would allow you to construct threshold wallets where any N of M parties can collaborate to spend from the wallet, but generating transactions doesn't leak information to anyone about how to generate transactions alone.

BitCoin, at present, only supports ECDSA signatures, which aren't linearly composable.

Traders take a risk in putting funds, fiat or otherwise, on an exchange. Many use domestic exchanges that have higher fees in an attempt to mitigate this risk. They are all well aware, but see the reward to be worth it.

On Ethereum this ecosystem is much more developed, and you can choose between EtherDelta, IDEX, 0xProject and Radex.

These exchanges eliminate counterparty risk because you control your funds at all times. They essentially act as matchmakers between those creating buy/sell orders and those who fill them.

Why would I want to put my money into something "decentralized" when my bank does a fine job?

Cryptocurrencies are complicated and nonsensical at times. I have yet to see anything in this space that makes me actually think it's the future of anything. It's far too risky.

Because you trust that your money will still be in the bank, in full, when you want to withdraw it. People in Cyprus, Venezuela, and Zimbabwe don't have that trust because it's been broken by bailouts and hyperinflation.

As long as the economy doesn't hyperinflate, and the banks don't haircut your accounts, and the IRS doesn't freeze your funds, and the government doesn't use civil forfeiture to take your money because they suspect you could be involved in criminal activity, your money is safe.

Therefore, many people see holding cryptocurrency as a hedge against that type of stuff.

Centralized exchange: send your FBI to exchange's wallet -> exchange updates your balance in its database, i.e. postgres -> trade for NSA -> withdraw NSA, which causes the exchange to send you NSA tokens (if they have them) and update another record in its DB.

The problem is in "if they have them". While normal banks are FDIC insured and a run on the bank won't prevent them from giving you your money, crypto exchanges provide no such guarantees. If the money is stolen from the exchange, like in the case of the OP, then you are SOL. Basically, you have to trust the exchange as much as you trust your bank. And clearly one entity is way more trustworthy than another.

In the decentralized exchange case, instead of trusting an organization to keep money safe through operational processes and tight regulation, you trust a smart contract. Provided that the smart contract has no bugs, this pretty much eliminates the need to trust the exchange. You trust it just as much as you trust mathematics.

Hope my explanation is not too verbose and makes sense.

When hundreds of millions of dollars worth can disappear in the blink of an eye like that, it adds a new element of risk aside from the risk of normal price drops. So it only stands to reason that investors would factor that into the value they place on bitcoin and the price would go down.

Have you ever noticed that currencies issued by corrupt and/or unstable governments tend to be worth little relative to the currencies of stable, well-governed countries?

To the crime victim, they just disappeared. Owning bitcoin is a very risky proposition for those who aren't extremely savvy in protecting themselves from thieves.