A powerful security technique to prevent theft of Bitcoins from a user's online wallet is to encrypt the user's private key with his password without ever stroring the PK directly in the database. Even if a hacker compromises the server they still won't be able to access the user's wallet without his password.
In case a website needs to have custodial control over a user's funds (for example, an exchange or escrow service in a marketplace) this solution isn't viable as the exchange needs to have complete control over the user's funds to move funds from one party to another (say from the buyer to the merchant or to a trader in an exchange). So it cannot be expected that the exchange must ask one party "permission" to transfer funds to the other party. Of course, the exchange or marketplace can encrypt the PK but since it would also need to host the decryption key somewhere on the server there's little benefit in encrypting the PK in the first place.
Is there a variation of this technique that might work even in a marketplace or exchange environment which requires that the owner (of the marketplace or exchange) maintain full control over a user's deposit?