Key Takeaways
- • Hackers stole $6.3 billion from Binance in what Reuters describes as the world's biggest crypto heist, spotlighting how exchanges insure digital assets against theft.
- • Crypto insurance coverage is far from uniform and depends on how assets are stored, how hackers gain access, and the specific policy terms, including limits, deductibles and exclusions.
- • Most standard crime and cyber policies do not cover cryptocurrency losses; specialist digital asset policies, largely written in the Lloyd's market and Bermuda, fill the gap.
- • Binance's Secure Asset Fund for Users (SAFU), established July 2018, held roughly $1 billion in bitcoin as of 2026, according to Binance's website.
- • Common exclusions include value fluctuations, policyholder fraud, and unsecured or negligent key management, which can limit payouts.
Summary
Hackers stole $6.3 billion from Binance in what Reuters characterizes as the world's biggest crypto heist, prompting renewed scrutiny of how cryptocurrency exchanges insure their digital assets against theft and cyberattacks. Reuters reports that insurance protection is far from uniform, with coverage dependent on storage arrangements, the method of intrusion and the specific policy wording.
Underwriting digital asset risk remains a niche business, offered largely by specialist insurers in the Lloyd's market and in Bermuda. Limited regulation and volatile crypto prices have long made insurers cautious, even as demand for protection against digital asset theft and claims against executives has grown. Data Bridge Market Research, cited by Reuters, values the global crypto insurance market at $9.37 billion in 2025 and projects it to reach $184.98 billion by 2033, citing institutional adoption and rising cyberattacks.
Digital asset policies typically combine crime insurance for theft and social engineering, cyber liability, errors and omissions coverage for software and smart contract failures, directors and officers insurance, and technology liability for infrastructure providers. Losses from a hack may be met through a mix of insurance payouts, the company's own capital and emergency reserves. Where losses exceed policy limits, the firm must rely on its own resources or other recovery arrangements.
Exchanges also maintain reserve funds. Binance established SAFU in July 2018 as an emergency reserve for security breaches and platform-level incidents. Binance's website shows the fund holds roughly $1 billion, entirely in bitcoin, as of 2026. Binance did not immediately respond to Reuters' request for comment on its insurance coverage.
Reuters notes that exclusions are common and can narrow protection. Typical exclusions cover value fluctuations, fraud by the policyholder and unsecured or negligent key management. Jacqueline Quintal, financial institutions and digital asset industry leader at Marsh, told Reuters that firms and their institutional clients must understand precisely what is covered, where exclusions and sublimits apply, and which risks are retained. She added that technology and security controls, governance and financial strength are equally important to resilience given the gap between probable loss and available insurance capacity.
Traditional crime policies were designed to protect physical property such as cash, securities and precious metals, so most do not cover cryptocurrency losses. Standard cyber policies generally exclude the loss or transfer of funds, and so typically do not cover the full value of stolen crypto unless digital asset coverage is added. In assessing claims, insurers examine how a breach occurred, which systems were compromised, and whether the exchange followed required controls over private keys, wallet access and transaction approvals. Whether an external hacker or an internal employee moved the assets can determine if crime or cyber coverage applies.
Underwriting digital asset risk remains a niche business, offered largely by specialist insurers in the Lloyd's market and in Bermuda. Limited regulation and volatile crypto prices have long made insurers cautious, even as demand for protection against digital asset theft and claims against executives has grown. Data Bridge Market Research, cited by Reuters, values the global crypto insurance market at $9.37 billion in 2025 and projects it to reach $184.98 billion by 2033, citing institutional adoption and rising cyberattacks.
Digital asset policies typically combine crime insurance for theft and social engineering, cyber liability, errors and omissions coverage for software and smart contract failures, directors and officers insurance, and technology liability for infrastructure providers. Losses from a hack may be met through a mix of insurance payouts, the company's own capital and emergency reserves. Where losses exceed policy limits, the firm must rely on its own resources or other recovery arrangements.
Exchanges also maintain reserve funds. Binance established SAFU in July 2018 as an emergency reserve for security breaches and platform-level incidents. Binance's website shows the fund holds roughly $1 billion, entirely in bitcoin, as of 2026. Binance did not immediately respond to Reuters' request for comment on its insurance coverage.
Reuters notes that exclusions are common and can narrow protection. Typical exclusions cover value fluctuations, fraud by the policyholder and unsecured or negligent key management. Jacqueline Quintal, financial institutions and digital asset industry leader at Marsh, told Reuters that firms and their institutional clients must understand precisely what is covered, where exclusions and sublimits apply, and which risks are retained. She added that technology and security controls, governance and financial strength are equally important to resilience given the gap between probable loss and available insurance capacity.
Traditional crime policies were designed to protect physical property such as cash, securities and precious metals, so most do not cover cryptocurrency losses. Standard cyber policies generally exclude the loss or transfer of funds, and so typically do not cover the full value of stolen crypto unless digital asset coverage is added. In assessing claims, insurers examine how a breach occurred, which systems were compromised, and whether the exchange followed required controls over private keys, wallet access and transaction approvals. Whether an external hacker or an internal employee moved the assets can determine if crime or cyber coverage applies.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.