I would assume that the cold stored coins are encrypted requiring t of n keys to decrypt using some standard secret sharing scheme. This should stop the 90% off

I would assume that the cold stored coins are encrypted requiring t of n keys to decrypt using some standard secret sharing scheme. This should stop the 90% offline being an easy target for internal issues and also for physical hold-ups / robbery. I'm not sure if publishing the exact method of this would be a good, or a bad thing. Having their bank / storage require a fixed notice period before allowing access to the offline funds - like a time lock - would also make it harder to steal the offline funds. Not knowing their stack outside of the guessed Ruby/Rails, I'd guess the weakest point lies around code deployment.