Bitfloor, mtgox and others allow me to keep a balance of both btc and usd that is not being traded. So the usd is apparently in the hands of the exchange company rather than at my bank. This is an advantage because it allows me to quickly buy in and out of btc without waiting for a wire transfer or paying for something like bitinstant.
Is my usd held by the exchange protected in anyway from hacking or other losses, the way it is at my bank?
Each exchange can be different. Essentially with every bit of funds held at an exchange, either fiat or bitcoins, the account holder becomes an unsecured creditor of the exchange.
Regulated exchanges of other securities, commodities and currencies and brokers of those exchanges have clear instruction to keep customer funds segregated from the operating funds so that those funds are not at risk if the exchange itself runs into financial issues.
Whether any of these regulations affect a Bitcoin exchange or brokerage may vary based on jurisdiction. It is possible these exchanges are operating without any regulatory oversight and thus no guarantee that they are holding all customers funds without lending those funds out or using those to fund operations.
An exchange that accepts deposits from an account-to-account (A2A) transfer could help lessen the risk. For instance, Camp BX and Mt. Gox accept deposits from Dwolla. So holding dollars at Dwolla until they will be used for trading is one approach to lessening the risk of keeping the funds at the exchange the whole time. BitFloor accepts CapitalOne 360/ING transfers, as another A2A example. And multiple exchanges accept transfers from OKPay.
Additionally there are site security concerns. If the service gets hacked, or an individual account gets hacked, those funds could be used to buy bitcoins and withdrawn -- with the losses assessed to the account holder. Use of two-factor authentication is essential a core requirement.
Bitfloor's shutdown offers a great example of the risk of holding fiat in an exchange:
Withdrawal can be cumbersome. Bitfloor requires you to submit a photo ID and a checking and routing number.
Withdrawal can be risky. If you give Bitfloor what they require, they have almost all the information someone needs to conduct ID theft.
Withdrawal means you lose your anonymity. All transactions that originated from Bitcoins bought via Bitfloor can be traced back to your real identity.
Withdrawal can be SLOW. If you read the thread above, you can see that users still haven't received their USD after months of waiting.
I would try at all times to have the minimum amount of fiat in any exchange.
