It's stupid to use PHP for backend when you run an exchange with 1 million clients.
If I was Karpeles, I had employed a couple of experienced C++ developers to rebuild the backend from the beginning.

He could have had a team of 3-5 C++ and bitcoin gurus for less than $300,000 / year = $900,000 total since 2011.
Which could have prevented all hackings, and they would probably also had recommended him to use better storages for the client funds.