Securing money or valuable info is not an entirely new concept. There are basic precautions, like complete physical control of the server for a start, basic precautions which many of these exchanges neglect (see inputs.io, run on a VPS!). They could learn a lot from banks, who have been doing this for decades.