Your coins are stored in addresses in the block chain. Thus your coins and my coins and everyone's coins are stored in every computer which makes up the Bitcoin network. The block chain contains every address in use, and every one that has ever been used along with how many coins are currently at that address.
This is why hacking your own client or wallet.dat isn't useful. Your coins aren't there they are everywhere.
For example you can lookup any of your (or anyone elses) addresses here and see the current value.
So what keeps other people from spending YOUR coins?
Spending Bitcoins is to create a transaction moving it from one address to another.
To create a transaction requires that you cryptographically sign the transaction with the private key of the address containing the coins (the public key). Since there is a mathematical relationship between public & private keys the rest of bitcoin network can verify that the transaction is properly signed. The "coins" (technically public key addresses and their current value) can be seen by anyone but those coins can only be moved by the persons in possession of the private key.
Your wallet.dat file contains all your public private key pairs. Anyone in possession of you wall.dat file (and encryption passphrase) can sign transactions as the owner of those public addresses and thus has control over the coins. This highlights why you must always safeguard your wallet.dat and encryption passphrase.
This method of storing value is unique to Bitcoin (and subsequent copycat coins).
To sum it up in a pair of sentences:
Your coins are stored in addresses (public keys), copies are made public and included in every node of the bitcoin network. However the security of those coins are ensured because only the person in possession of the matching private key can create a valid transaction to move them.