Crypto Custody Insurance: How the Market Is Evolving to Cover Digital Asset Risk

The cryptocurrency market exceeded $4 trillion in total capitalization during 2025, yet less than 1% of those assets carry insurance coverage. This protection gap, estimated at over $1 trillion in uninsured digital assets globally, represents one of the largest unaddressed risks in modern finance. As institutions allocate to digital assets and regulatory frameworks like the GENIUS Act formalize custody requirements, the crypto custody insurance market is evolving rapidly to close that gap.

Unlike traditional asset classes where insurance is mature and standardized, crypto custody insurance remains a specialized niche. Premiums are high, limits are low relative to the assets they cover, and exclusions are broad. But the market is growing: the global crypto insurance market reached an estimated $9.49 billion in 2025 and is projected to hit $13.75 billion in 2026, according to Grand View Research.

Why Crypto Assets Need Specialized Insurance

Traditional financial assets benefit from layered protections that do not exist in crypto. Bank deposits in the United States are covered by FDIC insurance up to $250,000 per depositor. Securities held at brokerages carry SIPC protection. Neither applies to cryptocurrency. The FDIC's April 2026 proposed rulemaking explicitly stated that crypto assets will not receive deposit insurance protections, regardless of whether the custodian holds a national bank charter.

This means that even assets held by regulated custodians like qualified custodians with national trust charters have no government-backed safety net. The only financial backstop available is private insurance, and the unique risk profile of digital assets makes underwriting them fundamentally different from insuring gold bars or stock certificates.

What Makes Crypto Risk Different

• Irreversibility: blockchain transactions cannot be reversed once confirmed, unlike wire transfers or card payments that support payment reversals
• Portability: a stolen private key can drain a wallet from anywhere in the world within seconds
• Concentration: a single key compromise can expose the entire balance, unlike physical assets distributed across vaults
• Attribution difficulty: on-chain theft can be obfuscated through mixers, bridges, and chain hopping, complicating recovery
• Valuation volatility: the USD value of stolen assets fluctuates between the theft and the claim, creating pricing complexity

What Crypto Custody Insurance Covers

Standard crypto custody policies, often called "specie" or "crime" policies, cover a specific set of risks related to the safekeeping of digital assets. The coverage model draws from traditional crime and specie insurance but adapts to crypto-specific threats.

Covered Perils

• External theft: unauthorized access to hot wallets or cold storage systems through cyberattack
• Internal fraud: employee collusion or rogue insiders who misappropriate private keys or sign unauthorized transactions
• Physical destruction: loss of signing devices or cold storage media through fire, flood, or natural disaster
• Key loss by custodian: operational failures where the custodian loses access to private keys through technical malfunction
• Social engineering: attacks targeting custodial employees through targeted phishing or impersonation to authorize fraudulent transfers

Standard Exclusions

• Market volatility: price declines after a theft are not covered, and policies typically value claims at the time of loss
• Regulatory action: asset freezes or seizures by government authorities fall outside coverage
• Smart contract bugs: losses from exploited vulnerabilities in smart contracts are excluded from custody policies
• User error: sending assets to wrong addresses, losing personal keys, or approving malicious transactions
• Blockchain-level failures: protocol bugs, consensus failures, or chain reorganizations that affect assets
• Self-custody losses: assets held in personal wallets without custodial oversight have traditionally been uninsurable

The Bybit precedent: In February 2025, hackers linked to North Korea's Lazarus Group stole approximately $1.5 billion in Ethereum from Bybit by compromising a third-party signing interface. The attack exploited the gap between cold storage security and the transaction signing workflow. This single incident accounted for roughly 69% of all crypto stolen from services in 2025, according to Chainalysis, and underscored why custody insurance must cover the full operational chain, not just the vault.

Key Players in Crypto Custody Insurance

The market spans traditional insurance giants entering the space and crypto-native providers building purpose-built products. Lloyd's of London syndicates have emerged as the primary underwriting venue, with multiple syndicates now actively writing crypto risk.

Traditional Brokers and Underwriters

Lloyd's of London syndicates, including Arch, Atrium, Beazley, and Canopius, have become the primary underwriting market for crypto custody risk. Marsh assembled the largest single facility at $825 million of capacity. Aon has arranged bespoke programs for exchanges and custodians. These traditional players bring actuarial discipline and reinsurance capacity but remain cautious: policies are individually underwritten with extensive security assessments, and capacity is limited relative to the assets seeking coverage.

Crypto-Native Providers

Evertas operates as a managing general agent (MGA) backed by Lloyd's syndicates, offering per-policy limits up to $420 million. The company nearly tripled its coverage limits in 2026, signaling growing underwriter confidence in its risk models. Coincover focuses on the retail and SMB segments, pairing Lloyd's-backed insurance with wallet protection technology and key recovery solutions.

Decentralized Insurance

Nexus Mutual operates a decentralized insurance alternative on Ethereum, modeled loosely on the Lloyd's syndicate structure. Members stake NXM tokens into cover pools, earning yield while underwriting risk. The protocol has protected over $6 billion in digital assets since 2019 and generated $5.7 million in cover fees during 2025. Claims are assessed through community voting rather than traditional adjusters. In late 2025, Nexus Mutual integrated with Symbiotic to create a reinsurance layer for scaling its underwriting capacity.

The Underwriting Challenge

Pricing crypto custody insurance is fundamentally harder than pricing traditional crime or property coverage. Underwriters face several structural challenges that explain why premiums remain elevated and capacity limited.

Limited Loss Data

Insurance pricing relies on actuarial models built from historical loss data. The crypto industry is barely 15 years old, and the nature of attacks evolves rapidly. The Bybit hack demonstrated a novel attack vector (compromising a third-party signing UI) that no historical data could have predicted. Underwriters must price tail risks they cannot model from precedent.

Catastrophic Loss Profiles

Unlike auto insurance or property coverage where losses are distributed and gradual, a single crypto breach can result in a total loss of insured assets. The $1.5 billion Bybit theft would have exhausted nearly any existing policy limit. Most crypto systems offer limited ability to contain damage once an attack begins, forcing underwriters to assume worst-case outcomes.

Security Assessment Complexity

Evaluating a custodian's security posture requires deep technical expertise in hardware security modules, key management protocols, signing workflows, and operational security practices. Underwriters must assess the entire custody stack: from hardware wallet configurations to employee access controls to disaster recovery procedures. This requires specialized expertise that few traditional insurers possess internally.

Premium benchmarks: Crypto custody insurance premiums typically range from 0.5% to 5% of the covered amount annually. By comparison, traditional fine art or precious metals storage insurance runs 0.1% to 0.5%. The premium differential reflects both the higher risk profile and the limited underwriting capacity in the crypto insurance market. As more data accumulates and security standards mature, premiums are expected to compress toward traditional asset insurance rates.

Premium Rates Compared to Traditional Asset Insurance

The gap between crypto premiums and traditional asset insurance is not purely a function of risk: it also reflects the immaturity of the market. With fewer underwriters competing for policies and limited reinsurance capacity, pricing power sits with insurers. As capacity grows and loss data accumulates, the market should see gradual premium compression for well-secured custodians.

The Self-Custody Insurance Problem

Traditionally, crypto insurance has required a custodial relationship: the insurer covers the custodian, and the custodian's clients benefit indirectly. This model breaks down for self-custody, where the user holds their own keys. Insurers have generally considered self-custody uninsurable because they cannot audit or enforce the security practices of individual key holders.

This creates a structural tension. The entire ethos of Bitcoin and decentralized finance favors self-custodial models where users maintain sovereignty over their assets. But that sovereignty has meant forgoing the financial safety net that insurance provides.

AnchorWatch and Insured Self-Custody

AnchorWatch launched in December 2024 as a Lloyd's of London coverholder offering insured Bitcoin self-custody. Their Trident Vault uses Bitcoin miniscript to create collaborative custody arrangements where the customer holds keys and AnchorWatch holds keys, with both required as signers. Time-locked recovery paths allow the vault to transition to pure self-custody after the policy period ends.

This model serves customers holding between $250,000 and $100 million in Bitcoin. By embedding insurance directly into the custody architecture using on-chain spending conditions, AnchorWatch can verify that insured assets remain within the policy's security parameters. The miniscript-based approach represents a significant innovation: insurance terms are partially enforced by the Bitcoin protocol itself rather than relying solely on legal contracts.

Distributed Custody and Insurance Models

As custody architectures evolve beyond the traditional single-custodian model, insurers must adapt. Multisig wallets, multi-party computation (MPC), and threshold signature schemes distribute key material across multiple parties, reducing single points of failure but complicating the question of who is insured and for what.

Consider a 2-of-3 multisig arrangement where one key sits with a custodian, one with the user, and one with a recovery service. If assets are stolen due to the custodian's key being compromised, the custodian's policy should cover the loss. But if the user's key and the recovery service's key are both compromised through unrelated attacks, coverage becomes ambiguous. Insurance products are only beginning to address these distributed custody models.

How Self-Custodial Layer 2s Change the Equation

Self-custodial Bitcoin Layer 2 protocols like Spark introduce a custody model that differs from both traditional custodians and raw self-custody. In Spark's architecture, users hold one key while a distributed set of operators collectively hold the other via FROST threshold signatures. Neither party can move funds unilaterally, and pre-signed exit transactions guarantee users can always withdraw to Bitcoin L1 without operator cooperation.

From an insurance perspective, this creates an interesting hybrid: assets are self-custodial (the user maintains a key required for any transfer), but the operator network provides a verifiable security layer. The 1-of-n trust model, where only one honest operator is needed to prevent fraud, offers a quantifiable security guarantee that underwriters can evaluate. This is structurally different from insuring a hardware wallet in someone's home safe, where the insurer has no visibility into security practices.

As self-custodial protocols mature, they may enable a new category of insurance products that cover the operator layer (operator key compromise, liveness failures) while leaving user-side key management as the policyholder's responsibility. This splits the risk profile into components that are individually more insurable than the whole.

Regulatory Drivers Shaping the Market

Several regulatory developments are accelerating demand for crypto custody insurance and defining what adequate coverage looks like.

US Frameworks

The GENIUS Act and related stablecoin legislation require issuers to maintain reserves with qualified custodians, which in turn creates demand for custody insurance at the custodian level. The SEC's custody rule (Staff Accounting Bulletin 121 and its successors) has pushed public companies that custody crypto to carry it on their balance sheets, increasing the incentive to insure against loss.

International Standards

The EU's MiCA regulation requires crypto asset service providers to maintain adequate safeguards for client assets, which regulators have interpreted to include insurance or equivalent guarantees. Similar requirements are emerging across VASP licensing frameworks in Singapore, Hong Kong, and the UAE.

Institutional Mandates

Institutional allocators increasingly require custody insurance as a precondition for investment. Pension funds, endowments, and family offices that gained crypto exposure through Bitcoin ETFs now expect the underlying custodians to carry insurance comparable to traditional asset custodians. This top-down pressure is arguably the single largest demand driver in the market.

The Protection Gap

Despite market growth, the gap between crypto assets under management and available insurance capacity remains enormous. By some estimates, fewer than one in five cryptocurrency holders carry any insurance coverage. According to Risk & Insurance, approximately 89% of global crypto holders remain uninsured, representing a protection gap that exceeds $1 trillion.

Several factors sustain this gap:

• Limited underwriting capacity: total available coverage across all providers is a fraction of the market's needs
• High premiums: at 0.5-5% annually, insurance costs can meaningfully reduce returns, especially for yield-generating strategies with thin margins
• Exclusion complexity: policyholders may believe they are covered for scenarios that their policies explicitly exclude
• Retail inaccessibility: most insurance products target institutional custodians, leaving individual holders without options
• Security assessment burden: the underwriting process requires detailed technical audits that smaller custodians cannot afford or pass

Scale of losses: Chainalysis estimated that crypto theft in 2025 reached an all-time high of $6.75 billion. With roughly 200 security incidents during the year, the average loss per incident was approximately $33.75 million. The insurance market's total capacity covers only a small fraction of annual losses, let alone the total assets at risk.

What Reduces Premiums

For custodians and institutions seeking coverage, several security measures demonstrably lower premiums and increase available limits.

• Cold storage ratios: keeping 95%+ of assets in cold storage with air-gapped signing significantly reduces risk profiles
• Multi-signature requirements: enforcing multisig or MPC for all withdrawals above a threshold
• SOC 2 Type II certification: third-party audits of security controls provide underwriter confidence
• Penetration testing: regular third-party security assessments with documented remediation
• Key ceremony protocols: documented, auditable key generation ceremonies with multiple witnesses
• Geographic distribution: distributing key material across multiple jurisdictions and physical locations
• Employee controls: background checks, access logging, and separation of duties for key holders

Looking Ahead

The crypto custody insurance market is approaching an inflection point. Several converging trends suggest the next few years will see significant expansion in both capacity and product innovation.

Regulatory mandates are creating non-discretionary demand for coverage. As frameworks like MiCA and the GENIUS Act take effect, custodians will need insurance not because it's prudent but because it's required. This guaranteed demand pool should attract new underwriting capital.

Advances in custody technology, including threshold signatures, secure elements, and protocol-level spending conditions, are making the risk more quantifiable. An underwriter evaluating a miniscript vault with on-chain enforcement of spending limits can model risk more precisely than one evaluating a custodian's internal access controls through questionnaires.

Decentralized insurance protocols like Nexus Mutual are expanding the total pool of underwriting capital by allowing anyone to participate as a risk bearer. While these protocols currently focus on DeFi-specific risks (smart contract exploits, depeg events), their expansion into custody coverage could meaningfully increase total market capacity.

For builders and users exploring self-custodial Bitcoin infrastructure, Spark's developer documentation details how its distributed custody model works at the protocol level. For a broader comparison of custody approaches and their risk profiles, see our analysis of Bitcoin custody solutions compared.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.