The problem is, enterprise-grade security is tough. Really tough. The incentive to hack exchange accounts and drain wallets is massive. We also can't rule out that state-sponsored hackers might be behind some of these attacks. Given the anonymous nature of crypto, it could be the perfect cyber-crime to hack an exchange and dump your ill-gotten goods elsewhere. Cold storage of assets in an exchange should be mandatory if regulation comes to the market. There's no reason why all the assets should be available immediately if a database is compromised. GDAX does this, and others should follow their lead. Even still, there's no beating an offline wallet, with your own chain of custody and a sturdy fire safe at your house, or a safe deposit box at your local credit union or bank.