Or stop holding massive amounts of client funds in a hot wallet.

We buy and sell coins.  
No hot wallet (no wallet at all on the server)
Manual verification of orders.
No user accounts (orders can't be changed once submitted so there is no value in trying to impersonate a user).
2 Factor encryption on all our trading & funding accounts.
Encrypted Enterprise grade database with off site backups.

Nothing is "hackproof" but we certainly present a lot smaller attack surface; a much less attractive target for hackers.  

What does every major (say 10,000+ BTC) hack have in common?  A massive shared online hotwallet holding user funds.  Maybe we start there.

Tis will be great when an exchange incorporates multisig transactions... Nobody can steal at that point

Nah, keep putting funds you can't afford to lose in a site coded in 4 days by a 17 year old. Totally solid business proposition.

Here's an idea:

If you don't have an actual security background with financial applications, don't code a fucking exchange.

I know that's a bit mindblowing, but think about it mr "learn ruby/python/php/node/perl (hey a guy can dream that kids are still into perl) in 24 hrs. book" guy.

They could do it the way I did it, go to university, get a degree and then work in the industry for 20 years while keeping up to date, gaining certification's attending conferences, going on vendor & paid seminars.

There is no short cuts to becoming competent unfortunately.

I thought this guy(gal?) makes the most sense.

i have met some good friends that are better educated on hacking then those that go to universities(nothing against the integrity of universities per se). I think its mostly due to there is the "unknowing" of certain problems and angles to hack at, so they learn about a systems vulnerabilities at all angles instead of a teacher or book lecturing a long list of ways (that tend to not burn into the memory) with the home-grown security skills you get the constant hands on learning and desensitisation of failure and patience on your belt. Of course just my view point and experience.

I believe NRF stated it the most politely and professionally tbh, if you're going to reference anyone reference that poster. I'm on a bit of a tirade this evening

In that case I shall take your opinions lightly --Just for this evening

I got that from your schpeal   definitely nothing beats experience that is for sure, I would append to your statement by saying that if we can cram experience into the class room in a rapid manner instead of the occasional hands on experience, the 50% of just listening about "things" that are only as relevant as the best the instructor can depict through story telling and pictures not to mention to relie on your own imagnation to paint the picture of what could be going on and left to assume the interpretation of the meanings the instructor is trying to convey and the other 50% of homework I guess I'm trying to say in a long paragraph is that once experience is integrated into the class room, students can be better educated out the door, they would have enough knowledge and experience to automatically come up with assumptions that are correct and in-line with what would be considered with practical security measures about the things they don't know or aware of.