If you hang around in /r/DarkNetMarkets and perhaps /r/SocialEngineering for a while you pick up soon enough that the biggest flaw in every plan or system ever is always the person, not the actual system itself. People don't usually get caught doing stuff, or get hacked in some way, because they were behind 7 proxies that day and not 8 or because they weren't running a VPN or whatever excuse you might think has to do with IT security. That all matters, but unless you're going up against the CIA no one's gonna do shit about your clever OPSEC system. Like if you are suspected to be working for a terrorist group or doing espionage or something, and at that point you're in absolute deep shit already. What fucks you up is that you were dumb enough to go to a post office with drugs in a bag and wrote down your real name and address somewhere, that you forgot your PIN or password, that you wrote it down somewhere but lost it, that your smartphone broke because you dropped it or someone stole it, that you clicked some link that was total bullshit and obvious scam but you clicked it anyway because you couldn't be arsed actually reading the email that's aaosijpdfoa@inter.net or some shit claiming to be amazon asking you something about your order, that you didn't see the email to reset your password because it was in the spam folder for months and you lost your account, and so on and so forth.

With exchanges there is the added danger that really you are just trusting someone to hold all your money with no actual guarantee that they will, whatsoever. Just what exactly are you going to do if Bitfinex or whatever announces oh no, we've been "hacked" and we "lost" everyone's money! Even if you had millions on there, well you had millions. Who's gonna be your lawyer now to take these guys to court? Where are these people anyway? Aside from that it always drove me up the wall how pathetically run so many of these exchanges are. Like running a decent cryptocurrency exchange is basically a licence to print money, because you profit from EVERY transaction on it, no matter if the person made a good deal or a bad deal. How do people fuck this up? Just find some IT security expert, pay them 100 grand to turn your exchange into Fort Knox and happily make money forever. But no, "the exchange went down because of too much volume". Fucking pathetic lol. It's like this shit runs in someone's computer in their spare room or something.