Agree completely. I thought complacency was a large portion of the issue, but didn't have evidence to back it up. Personally, i was running to an external wallet for the first few batches, but I'm small time. Anything that might have been taken is maybe $30 of BTC since my last external dump. To keep escrow funds in a static address sounds like complete suicide to me.