They're all custodied at coinbase. They're not beyond hacking, but if one is hacked, most of them are. There's only like 2 that custody elsewhere.
Discussion
Good point, although coinbase is likely compartmentalizing the management of those huge accounts