As long as you are the sole owner of a private key then only you can spend/move the associated balance. The blockchain itself is the truth as mathematically verified by computers around the world so attacking it is not really feasible. A thief is more likely to try getting your private key by tricking you and/or installing software on your computer. In the cases of exchanges disappearing with funds, they are able to do so if the exchange controls the private key. They often do. For this reason it is advisable to use only licensed businesses and withdraw your funds after transactions.