I recently posted this article at Bitcoin Magazine:
Don't Get Goxed - Use The Five Parties ModelIn Summary45% of Bitcoin Exchanges have failed since 2010. 70% of those failures were due to security breaches, and the remainder due to inside theft or (if you believe Mark Karpeles) gross incompetence.
The Five Parties Model of Governance helps to avoid problems like MtGox by separating the powers of the parties involved in the transactions and having everyone watch each other.
The Five Parties are:
1. Issuer's Board of Directors (holder of value). Their job is to write and uphold the contract for escrow of value, deliver the service, and make sure the other parties do their jobs.
2. The Trustee of the Digital AssetsThe Trustee is the person who creates/destroys or transfers the internal digital assets of the Bitcoin Exchange. He can only create or destroy value according to the rules set forth by the Issuer, and at the request of the Manager.
3. The Manager, or Trading DeskThis may be an employee of the Issuer (Bitcoin Exchange) or in some cases a separate business that provides the market for the Digital Issuance (such as is done on NASDAQ). The manager runs the daily trading (in/out exchanges) using an internal float account (ie. MtGox internal BTC account) and an external float account in the reserve asset (ie Bitcoin Hot Wallet).
4. OperatorThe operator runs the software that keeps track of the value. Transactions can only be authorized with signing keys (like Bitcoin transactions). The Operator should never have those keys. The operator is the IT department that runs the exchange, or in the case of Bex.io, an external company that provides hosted exchange software.
5. The Public as AuditorBy making the internal net account balance public through an API, along with the reserve account addresses (cold wallets), the Public is able to verify the asset backing the internal accounts are 100% liquid at all times.
Here is a diagram of a simple Five Parties Model:
http://btcmag.9wizards.netdna-cdn.com/wp-content/uploads/2014/02/5PM1.pngFive Parties Model for a BTCitcoin ExchangeFor a Bitcoin Exchange you need two Five Parties Model instances set up in mirror - one for the internal user accounts, and one for the Bitcoin cold wallets. Here is a diagram that shows governance for a Bitcoin Exchange.
http://btcmag.9wizards.netdna-cdn.com/wp-content/uploads/2014/02/2-Sided-5PM-31.pngHow It works in PracticeIn practice you want to make sure that the Manager cannot piss away the Cold Wallet BTC reserve like MtGox claims they did.
Here is how you control the deposit or withdrawal of BTC from the reserve in a controlled firewalled manner:
http://btcmag.9wizards.netdna-cdn.com/wp-content/uploads/2014/02/Bailment-434x620.pngYou can get more detail by reading the article at Bitcoin Magazine.
I would really appreciate community feedback.
For more detail and excellent diagrams, see the article:
Don't Get Goxed - Use The Five Parties Model