@Slow death. The solution is for the exchange to be smarter than the thieves. The thieves will never stop trying as long as there is something valuable in the vault.
You can only hire so many pen-testers. At best, you can outsmart most thieves, but never all of them. That's why there has been so much emphasis on reducing losses to limited hot wallets in these situations. All in all, this could have been a lot worse.
Agreed. However, if you cannot run a secure exchange that holds 100s of millions of people's money then you have no right to be running an exchange. There will always be thieves that will certainly never change.