Crypto exchange failures raise hard questions about custody practices