Crypto insurance

Two policy forms provide this coverage: a commercial crime policy covers dishonest acts against the custodian, including theft of private keys by an external attacker, theft by an employee and fraudulently induced transfers. A specie policy is the first-party property form, adapted from the cover written for vaulted valuables, and it responds to the loss or physical destruction of key material in storage.

The insured peril in both cases is the key, not the coin. An underwriter therefore examines the hardware, the software and the processes across the whole key lifecycle, from generation through backup, storage and retrieval to destruction, which is the point Norton Rose Fulbright makes to underwriters. Norton Rose Fulbright also identifies a feature with no physical analogue: a copy of a key is as powerful as the original, so a loss can occur without anything disappearing. MPC wallets cover the technology underwriters are assessing.

The split between online and offline keys runs through every policy, because the two risks are not comparable. Cold storage keeps key material offline, which is what most underwriters were historically willing to insure at all, and it carries the higher sublimit. A hot wallet is connected in order to process withdrawals, which is the exposure attackers actually use, and where it is covered the sublimit is far smaller.

Some custody programs now cover the full lifecycle including hot, cold and assets in transit, while others remain cold-only. The comparison of disclosed custody programs by Spark shows the range across providers. The question to put to a custodian is therefore not whether it is insured but which storage states are covered and at what sublimit, since your coins sit in the hot wallet exactly when you are withdrawing them.

The policy exclusions rule out compensation for market losses: a fall in price is not an insured event, and no policy in this market pays for it. Protocol failure and smart contract exploits are out of standard cover, so a loss inside a DeFi protocol is uninsured even where the custodian's own keys were never touched. War, terrorism and nuclear events are excluded as they are in any policy, and so is confiscation or seizure by a government authority.

Three further exclusions apply to client actions: a loss caused by the asset owner's own key mismanagement is not the custodian's insured event, which is why a lost seed phrase in self-custody is never covered by anybody. A breach of the client's own credentials, where the attacker logs in as the client, is excluded. And several programs exclude losses where the client holds key shares itself, which is worth checking against any arrangement that gives the client part of the signing power.

Insurance capacity is concentrated among specialists, with Lloyd's of London syndicates writing the bulk of it, arranged in towers where a lead underwriter sets the terms and further layers sit above, which is how a limit larger than any single syndicate's appetite is assembled. Named Lloyd's participants in this market include Arch, Canopius, Atrium and Beazley.

One underwriting convention matters to a holder: Lloyd's has been prescriptive that limits are denominated in fiat currency and not in crypto, precisely because of volatility. The practical consequence is that a limit set in dollars covers fewer coins after a price rise, so the protection relative to the holding shrinks in exactly the market where it would be claimed on.

Disclosed custody programs run from tens of millions to several hundred million in limit, against a crypto market measured in trillions. Even a large program is a fraction of what a major custodian holds, and no custodian insures its full book, because the capacity to do so does not exist in the market.

Read the arithmetic before relying on the cover. A limit shared across all clients means a single large incident exhausts it, and the recovery is then shared pro rata. Insurance in this market is protection against a contained incident, such as an insider theft or a compromised hot wallet, and it is not protection against the failure of the custodian. That is why risk management treats a custodian as a counterparty limit and not as an insured certainty.

Asset segregation and provider liability offer stronger protection than an insurance policy. Under MiCA a crypto-asset service provider holding client assets must hold them separately from its own, so client coins are not part of its estate if it fails, and it must have arrangements to safeguard client ownership rights, particularly in insolvency. The provider is liable to the client for loss of a crypto-asset resulting from an incident attributable to it, up to the market value of the asset lost.

The regime does not mandate insurance, which backs the custodian's own liability: a provider that must pay a client for a loss wants a policy behind that obligation, because a liability a failed firm cannot meet is worth nothing. The order of questions for a client is therefore segregation first, then liability, then the policy. Crypto custody in Germany and the CASP license set out the duties.

Self-custodied coins have no insurance available in any ordinary market: there is no insurable interest an underwriter will write for an individual's own key management, and a lost seed phrase is the textbook excluded loss. Household contents and cyber policies do not reach crypto-assets either.

What exists instead is cover attached to a custodian, which is a reason to use one for a meaningful holding, and the protection then runs through the custodian and its limits, never to you directly. Crypto inheritance covers the related planning question, since the loss that most often removes a self-custodied holding is not theft but the death of the only person who knew the key.