user59319: Let suppose we have e-shop where you can buy with bitcoins. In this case, there is bitcoind that have locked wallet. In fact this wallet is never unlocked, because you can have another wallet on different computer with same wallet.dat file.
So in case of e-shops, even website is hacked and the hacker have full access of the server, he / she will not be able to steal any coins.
However in case of coin exchanges, there must be automatic withdrawal process. I am sure some exchanges withdraw money manually, but exchanges like Bitstamp, Bittrex, Binance, CoinExchange.io and others have such high volumes and this definitely can not be done manually.
How these exchanges protects against hacks?
Because the wallets must be unlocked, so all hacker need to do is to type bitcoin-cli send ....
If the wallet is locked, hacker might find the password somewhere on the server. Then he / she might unlock the wallet and send the coins.
Other way is hacker to "insert" his payment in payment queue and the system will send the coins for him.

user84720: Remember that bitcoind is a reference implementation, but bitcoin itself is the abstraction of it.
In production environments not always you run the same software as in a desktop. 
There are other bitcoin implementations that are meant for use in production systems at scale. One of them is called bcoin by the folks at purse.io and open sourced. And there are others more even. 

user7272: (Sane) Exchanges don't store keys on an online, publicly accessible server or instance of bitcoind.
The normal approach is to set up a minimum of three wallets:

The receiver wallet - This wallet controls the addresses given to users to deposit their coins to. It is good practice to keep such keys entirely offline, as it is uncommon to need to move the BTC immediately after a deposit is received. Instead, exchanges tend to sweep the funds deposited over the last day/week every once in a while. These occasional txs can easily be signed offline and broadcasted when needed, asynchronously from the day to day operations of an exchange.
The cold wallet - This wallet is, once again, an offline wallet and holds the majority of the exchange's coins. Coins from the receiver wallet addresses are sent here. Additionally, cold wallets tend to use multisignature scripts/contracts to ensure that no single operator can move funds unilaterally. Usually, the founders/high level employees of an exchange will hold keys to this wallet, and multiple people will be required to sign a transaction before coins can be moved. 
The hot wallet - These are usually the only keys that are available on a server. Even so, the server holding these keys will generally not have external internet access, and will only be accessible over the exchange's private network, and only from certain, authorized applications holding the correct credentials. This wallet contains a limited amount of coins, usually small enough that in the event of a hack, the exchange's own funds are able to cover the losses.


59319: <p>Let suppose we have e-shop where you can buy with bitcoins. In this case, there is <code>bitcoind</code> that have locked wallet. In fact this wallet is never unlocked, because you can have another wallet on different computer with same wallet.dat file.</p>

<p>So in case of e-shops, even website is hacked and the hacker have full access of the server, he / she will not be able to steal any coins.</p>

<p>However in case of coin exchanges, there must be automatic withdrawal process. I am sure some exchanges withdraw money manually, but exchanges like Bitstamp, Bittrex, Binance, CoinExchange.io and others have such high volumes and this definitely can not be done manually.</p>

<p>How these exchanges protects against hacks?</p>

<p>Because the wallets must be unlocked, so all hacker need to do is to type <code>bitcoin-cli send ....</code></p>

<p>If the wallet is locked, hacker might find the password somewhere on the server. Then he / she might unlock the wallet and send the coins.</p>

<p>Other way is hacker to "insert" his payment in payment queue and the system will send the coins for him.</p>
 84720: <p>Remember that <code>bitcoind</code> is a reference implementation, but bitcoin itself is the abstraction of it.</p>

<p>In production environments not always you run the same software as in a desktop. </p>

<p>There are other bitcoin implementations that are meant for use in production systems at scale. One of them is called <code>bcoin</code> by the folks at purse.io and open sourced. And there are others more even. </p>
 7272: <p>(Sane) Exchanges don't store keys on an online, publicly accessible server or instance of <code>bitcoind</code>.</p>

<p>The normal approach is to set up a minimum of three wallets:</p>

<ol>
<li>The receiver wallet - This wallet controls the addresses given to users to deposit their coins to. It is good practice to keep such keys entirely offline, as it is uncommon to need to move the BTC immediately after a deposit is received. Instead, exchanges tend to sweep the funds deposited over the last day/week every once in a while. These occasional txs can easily be signed offline and broadcasted when needed, asynchronously from the day to day operations of an exchange.</li>
<li>The cold wallet - This wallet is, once again, an offline wallet and holds the majority of the exchange's coins. Coins from the receiver wallet addresses are sent here. Additionally, cold wallets tend to use multisignature scripts/contracts to ensure that no single operator can move funds unilaterally. Usually, the founders/high level employees of an exchange will hold keys to this wallet, and multiple people will be required to sign a transaction before coins can be moved. </li>
<li>The hot wallet - These are usually the only keys that are available on a server. Even so, the server holding these keys will generally not have external internet access, and will only be accessible over the exchange's private network, and only from certain, authorized applications holding the correct credentials. This wallet contains a limited amount of coins, usually small enough that in the event of a hack, the exchange's own funds are able to cover the losses.</li>
</ol>
