Operational risk is usually managed with risk limits, reporting, dashboards. Since it is difficult to model quantitatively VaR tends not to be very applicable

Operational risk is usually managed with risk limits, reporting, dashboards. Since it is difficult to model quantitatively VaR tends not to be very applicable - except as a concept. The 1 in 200 event. The concept of setting your risk limit at a non-lethal amount is completely valid. I don't know how bitcoin wallets work particularly, but simply having no more value stored in a hot wallet than can be tolerably lost (or a way of sharing that risk with users) in a single event seems reasonable. Then just work hard to prevent said loss since it destroys value.