The theft of $6.3 billion from Binance, the largest crypto heist on record, has drawn attention to how cryptocurrency exchanges insure their digital assets, and how much of such a loss insurance can actually cover, Reuters reported.
Protection varies widely. Whether a policy pays out depends on where the assets were held, how the attackers got in and the precise wording of the cover.
A niche market
Demand for insurance against digital asset theft, and against claims targeting company executives, has grown alongside the rise of cryptocurrencies and the crime that has followed it. Even so, many insurers remain cautious, put off by limited regulation and sharp swings in crypto prices.
As a result, underwriting these risks is still largely a specialist business, concentrated in the Lloyd’s market and in Bermuda.
Data Bridge Market Research valued the global crypto insurance market at $9.37 billion in 2025 and expects it to reach $184.98 billion by 2033. It attributes the growth to greater institutional use of cryptocurrencies and a rise in cyberattacks and thefts.
What the policies cover
Digital asset insurance is designed for exchanges, custodians and other crypto businesses. It addresses risks specific to blockchain technology, such as the theft or loss of private keys, breaches of wallet security, flaws in smart contracts and failures in custody.
Companies can combine several types of cover. Crime insurance deals with theft, social engineering and scams. Cyber liability covers breaches, hacks and the regulatory response. Errors and omissions policies address software bugs and smart contract failures. Directors and officers insurance protects executives against lawsuits, and technology liability is aimed at infrastructure providers.
Why standard policies fall short
Conventional crime insurance generally excludes cryptocurrency, as it was built to protect physical assets such as cash, securities and precious metals.
Standard cyber policies also offer limited help. They can pay for forensic investigations, customer notifications and legal costs, but they usually exclude the loss or transfer of funds. Unless specific digital asset cover has been added, they are unlikely to reimburse the full value of stolen crypto.
Specialist policies have their own limits. Insurers commonly exclude losses caused by price movements, fraud by the policyholder, and keys that were left unsecured or managed negligently. These exclusions can also make cover harder to obtain in the first place.
How claims are judged
After a breach, insurers examine how it happened, which systems were compromised and whether the loss falls within the policy. They may also check whether the exchange followed required security procedures on private keys, wallet access and transaction approvals.
Who moved the assets can be decisive. Whether an outside hacker stole credentials or an employee deliberately transferred funds can determine whether the loss falls under a crime policy or a cyber policy.
Filling the gap
When an exchange is hacked, losses are typically met through a mix of insurance payouts, the company’s own capital and emergency funds set aside for customers. Policy limits, deductibles and exclusions determine how much insurers pay. Anything beyond that falls on the company’s own resources or other recovery arrangements.
Binance set up its Secure Asset Fund for Users (SAFU) in July 2018 as an emergency reserve for extreme events such as security breaches. According to the company’s website, the fund holds about $1 billion, all in bitcoin.
Binance did not immediately respond to a Reuters request for comment on its insurance cover.
(Reuters)
