That's a serious problem. Controlling access to the vault, when it's being accessed frequently, is hard. It's even harder for Bitcoin, where the threat is someone copying the data. You can have your original data and not have the assets it represented.

Question to ask Bitcoin exchanges: are your people bonded, and who's the bonding company. If they answer "What?", they're clueless about vault operations.