Digital Asset Insurance: How Institutions Are Securing Bitcoin in 2026
Digital Asset Insurance:
%20(1).png)
In January 2025, hackers stole approximately $1.5 billion in Ethereum from the Bybit exchange in what became the largest crypto theft in history. Bybit had insurance coverage. Clients were made whole. The exchange survived.
In contrast, the 2022 FTX collapse — where customer funds were misappropriated rather than stolen by external hackers — left creditors facing years of bankruptcy proceedings and partial recoveries. The difference in outcome between insured theft and uninsured custodial fraud illustrates exactly why institutional digital asset insurance has moved from niche consideration to essential infrastructure in 2026.
Bitcoin crossed $100,000 for the first time in late 2024 and has continued to establish itself as a permanent institutional asset class. The US Bitcoin ETF market, launched in January 2024, has accumulated hundreds of billions in assets under management. Corporate treasuries hold Bitcoin. Sovereign wealth funds are exploring allocations. Family offices that once dismissed digital assets are now managing significant Bitcoin positions. For all of them, the question is no longer whether to hold Bitcoin — it is how to hold it safely and insured.
This guide explains what digital asset insurance covers, how the market is structured, what it costs, and which providers are setting the standard in 2026.
Why Standard Insurance Doesn't Cover Digital Assets
The fundamental problem with insuring digital assets is that they don't fit any of the traditional insurance categories neatly. They are not real property. They are not money in the banking sense. They are not securities in the way that stocks and bonds are. They are a novel asset class — bearer instruments recorded on distributed ledgers, controlled by whoever holds the private keys.
This novelty means that standard commercial property insurance, commercial crime insurance, and financial institution bonds all have gaps when applied to digital assets. Standard policies were written before this asset class existed, and their definitions of covered property, covered perils, and covered loss scenarios may leave digital assets entirely outside the coverage trigger.
Insurance policies contain specific exclusions that clients must understand. Coverage generally does not extend to losses from private key mismanagement by clients themselves, smart contract vulnerabilities in blockchain protocols, or market value declines. Most standard financial institution policies also exclude "speculative" or "unregulated" assets — categories that digital assets sometimes fall into depending on how the policy is drafted.
The digital asset insurance market has developed specifically to fill this gap, with specialist carriers, Lloyd's of London syndicates, and dedicated insurtechs creating bespoke products that address the actual loss scenarios institutional digital asset holders face.
The Core Risk Scenarios — What Needs to Be Covered
External Theft (Hacking)
The headline risk: a cyberattack that exploits vulnerabilities in hot wallets, exchange infrastructure, API connections, or internal systems to move digital assets to addresses controlled by the attacker. Coinbase reportedly has a $255 million crime policy available for losses sustained due to platform-wide breaches, warning investors that its crime policy "does not cover any losses resulting from unauthorized access to your personal Coinbase account due to a breach or loss of your credentials."
This distinction matters for institutional holders: institutional-grade custody policies typically cover theft resulting from external attacks on the custodian's infrastructure. They do not cover losses arising from the individual client's own compromised credentials or security failures.
Insider Theft and Employee Dishonesty
The less-discussed but equally real risk: employees or insiders at a custody provider who collude to misappropriate assets. This is the scenario that FTX crystallised in the public consciousness, though FTX's failure was ownership-level fraud rather than employee-level theft. Onramp Bitcoin secured a $100 million insurance facility from Lloyd's of London (Canopius syndicate) that specifically targets internal threats such as collusion — addressing the human vulnerabilities inherent in any custody framework.
Insider theft coverage requires specific underwriting because it demands assessment of the custody provider's internal controls, separation of duties, multi-party authorisation requirements, and governance frameworks. Custody providers with strong operational security — multi-signature requirements, mandatory vacation policies, background checks, air-gapped cold storage — are both lower risk and more insurable.
Physical Loss of Private Keys
Cold storage — offline storage in hardware wallets or HSMs in physically secured vaults — eliminates digital attack vectors but creates physical loss scenarios. A natural disaster, fire, or physical theft at a vault facility could destroy or make inaccessible the hardware storing private keys. Without the private key, the Bitcoin is permanently inaccessible regardless of how much it is worth.
Institutional custody providers maintain geographically distributed vault infrastructure precisely to address this concentration risk — but the insurance programme must explicitly cover physical loss of key material, not just cyber theft.
Operational Errors
Key mismanagement — accidental deletion, loss, or destruction of private keys — is a coverage category that some specialist policies address and that standard crime policies typically exclude. For self-custody institutional holders managing their own key infrastructure, this coverage is significant. The permanence of loss from key deletion — unlike a lost password, there is no recovery mechanism — makes this an irreversible event that insurance must address or leave completely unmanaged.
How the Market Is Structured in 2026
The digital asset insurance market has consolidated around Lloyd's of London as the primary centre of capacity and innovation, with specialist insurtechs acting as Lloyd's cover holders or placement specialists.
Lloyd's launched a new type of liability insurance policy for crypto assets with a dynamic limit that increases or decreases in line with price changes of crypto assets — ensuring the insured is always indemnified for the underlying value of their managed asset even if it fluctuates over the policy period. The policy is backed by a panel of Lloyd's insurers including TMK and Markel.
This dynamic limit innovation addresses one of the fundamental challenges in insuring volatile assets: a fixed-limit policy written when Bitcoin was at $60,000 becomes materially underinsured when Bitcoin reaches $100,000. Dynamic policies that track the underlying asset value maintain adequate coverage through price movements.
Industry sources indicate institutional custody providers typically secure policies ranging from $100 million to $500 million through syndicates of specialty insurers. The concentration of coverage across multiple Lloyd's syndicates — rather than a single underwriter — distributes the risk and provides more capacity than any single insurer could offer for this asset class.
The market is growing but still small relative to assets under custody. Evertas, the world's first company dedicated exclusively to crypto insurance and the only cryptoasset insurer selected by Lloyd's as a listed coverholder, offers coverage of up to $360 million per policy — by leaps and bounds the highest per-incident coverage limits in the industry. Even at this scale, a single large institutional Bitcoin holding can exceed available insurance market capacity.
Cold Storage vs. Hot Wallet — The Coverage Distinction
The most important technical factor in digital asset insurance pricing and coverage is the custody architecture — specifically, how much of the digital asset portfolio is held in cold storage versus hot wallets.
Cold storage — where private keys are held offline, in air-gapped environments, without any internet connectivity — is the most secure architecture and attracts the most favourable insurance terms. Approximately 95% of institutional custody arrangements hold the majority of assets in cold storage.
Hot wallets — online, accessible systems required for rapid settlement and operational flexibility — carry significantly higher cyber risk and are priced accordingly by insurers. Most institutional policies have separate sub-limits or pricing for hot wallet balances versus cold storage balances.
BitGo has secured a $250 million policy through Lloyd's and other insurers covering digital assets where the private keys are held 100% by BitGo Trust Company or BitGo, Inc., protecting against third-party hacks, employee dishonesty, and physical security breaches. The coverage specifically applies when the custodian holds all keys — a structure that enables clean underwriting because the risk assessment is focused on a single, auditable custody provider.
The Underwriting Process — What Insurers Examine
Obtaining institutional-grade digital asset insurance requires detailed operational due diligence that goes well beyond a standard insurance application. Securing coverage entailed a thorough examination of operational security, governance frameworks, and technical safeguards. Canopius conducted extensive due diligence on custody processes, reviewing multi-signature consensus requirements, internal controls that limit any single entity's ability to compromise assets, and the physical and digital security architecture.
Underwriters assess:
Key management architecture: How are private keys generated, stored, and accessed? What multi-signature requirements govern transactions? Are HSMs (Hardware Security Modules) used? Are keys distributed across geographic locations?
Access controls and internal governance: How many people have access to cold storage? What multi-party authorization is required for transactions above defined thresholds? What monitoring and audit logging exists?
Regulatory compliance and audits: Is the custodian a regulated entity? Do they undergo SOC 1/SOC 2 audits? Are they subject to NYDFS oversight or an equivalent?
Insurance history: Have prior claims been made? What was the nature of any previous incidents?
Operational security: Background checks, security training, employee monitoring, physical vault access procedures, and penetration testing frequency all inform the underwriter's assessment.
This rigorous underwriting process is not a barrier — it is a feature. Institutions that can demonstrate strong operational security obtain coverage at better terms. The underwriting process itself drives security improvements throughout the industry.
Best Digital Asset Insurance Providers in 2026
Evertas — Best Specialist for Crypto-Native Policies
Evertas is the world's first and only company dedicated to crypto insurance backed by Lloyd's of London, selected by Lloyd's as a listed coverholder in their official marketplace. All Evertas policies carry the highest achievable creditworthiness ratings: A- (IX) or A+ (XV). Coverage of up to $360 million per policy is available — the highest per-incident limits in the industry. Evertas policies are designed by crypto natives and cover a wide range of customers including mining operations, crypto custodians, exchanges, investment funds, family offices, and AI infrastructure operators. For institutional holders seeking the highest available coverage limits with crypto-native underwriting expertise, Evertas is the benchmark.
Anchor Watch — Best for Bitcoin-Specific Self-Custody Insurance
Anchor Watch policies are underwritten by A+ rated Lloyd's of London and are specifically designed for Bitcoin holders — including those who self-custody using multisig hardware wallets. Anchor Watch integrates with their Trident custody product, offering a seamless solution for institutional Bitcoin holders who want to maintain direct custody while obtaining genuine insurance protection. Their focus on Bitcoin-specific risk and the integration of custody and insurance in one solution is distinctive in the market.
Coin cover — Best for Exchange and Wallet Integration
Coin cover works in partnership with BitGo wallets and protects $300 million+ of crypto spanning 200+ currencies held in more than 15,000 wallets. Their dynamic limit policy — the first of its kind, backed by Lloyd's PIF members including TMK and Markel — ensures coverage scales with asset value. Coin cover's standard plans begin at $159 per year for up to $10,000 in coverage, with pro plans at $749 per year for up to $100,000. Institutional limits are available on request. For exchanges and wallet providers seeking to offer insured custody as a product feature, Coin cover's integration capabilities are market-leading.
Native Insurance Brokerage — Best for Bespoke Institutional Placement
Native is a specialist insurance brokerage connecting digital asset firms to comprehensive, high-quality insurance solutions. Their expertise in risk assessment and insurer engagement proved instrumental in the Onramp Bitcoin $100 million Lloyd's facility placement. For institutions assembling bespoke programmes — combining multiple coverage layers, multiple custody architectures, and multiple insurers — Native provides the specialist placement expertise that generalist brokers cannot.
BitGo Trust — Best Regulated Custodian with Embedded Insurance
BitGo is a global digital asset custodian offering a regulated, insured, and institutional-grade custody framework. Their infrastructure leverages fully offline cold storage, multi-signature or MPC key management, and insurance protection of up to $250 million. For institutions seeking to outsource custody entirely to a regulated fiduciary with embedded insurance — rather than assembling a separate custody and insurance programme — BitGo's integrated solution provides regulatory compliance, operational security, and coverage in a single relationship.
Practical Steps for Institutional Digital Asset Insurance
Audit your custody architecture before approaching the market. Insurers underwrite custody arrangements, not just asset values. Document your key management procedures, multi-signature requirements, cold storage percentage, and governance controls before beginning the insurance application process.
Separate hot wallet and cold storage limits explicitly. Your programme should have distinct coverage for hot wallet balances (higher risk, higher premium, potentially lower limits) and cold storage (lower risk, higher limits available). Don't apply a single limit to both.
Review coverage limits against current asset values regularly. Bitcoin's price volatility means that a policy adequate at the time of placement can become materially underinsured within months. For volatile assets, dynamic limit policies or quarterly limit reviews are essential.
Understand what custodial insurance does not cover. Client-side credential loss, smart contract exploits in DeFi protocols, and market value decline are not covered. Institutional holders must maintain their own operational security regardless of custodian coverage.
Frequently Asked Questions
Q1: Does institutional crypto insurance protect individual account holders?
A1: Custodial insurance policies protect the custodian's overall asset pool — they are not individual client policies. When a custodian has a $250 million policy and suffers a hack, the policy compensates the custodian for covered losses, which are then distributed to affected clients according to the custodian's claims and recovery process. Individual clients are not direct policyholders. The critical caveat — illustrated by Coinbase's policy language — is that custodial policies typically cover platform-wide security breaches, not individual account compromises resulting from the client's own credential loss. Self-custody holders who want direct, individual insurance need a product like AnchorWatch or Coincover's retail tier.
Q2: What is a dynamic limit crypto insurance policy?
A2: A dynamic limit policy automatically adjusts the coverage limit in line with the price of the insured digital asset. If Bitcoin doubles in price, the policy limit doubles with it — ensuring the insured is always covered for the underlying value of their holdings. Coincover's dynamic limit policy ensures the insured is always indemnified for the underlying value of their managed asset even if it fluctuates over the policy period. Without dynamic limits, a fixed-limit policy written during a low-price period can become significantly underinsured as asset values rise — a particularly acute problem for volatile assets like Bitcoin and Ethereum.
Q3: Can a corporate treasury holding Bitcoin get insurance on those holdings?
A3: Yes — this is exactly what institutional digital asset insurance addresses. Companies with Bitcoin treasury holdings — following the model established by MicroStrategy, Tesla, and others — can obtain coverage through specialist Lloyd's syndicates and dedicated crypto insurance providers. The underwriting assessment focuses on the custody arrangement: is the Bitcoin held with a qualified custodian, in cold storage, with appropriate multi-signature controls? Companies that hold Bitcoin directly in self-custody also have insurance options, particularly through Anchor Watch for Bitcoin-specific coverage. The programme should be reviewed by a specialist broker who understands both the custody architecture and the available insurance market.
Q4: Why is most crypto insurance capacity concentrated at Lloyd's of London?
A4: Lloyd's of London's syndicate structure makes it uniquely suited to insuring novel, high-risk, or emerging risk categories where standard admitted carriers lack the expertise or appetite to underwrite. Each Lloyd's syndicate operates independently, and multiple syndicates can participate in a single risk — enabling large limits ($100 million to $500 million) that no single insurer could provide alone. Lloyd's has been innovating in digital asset coverage since 2018-2019, and its Product Innovation Facility has specifically supported the development of new crypto insurance products. The combination of specialist expertise, large aggregate capacity, and Lloyd's cover holder system that allows dedicated crypto insurtechs like Evertas to underwrite within the Lloyd's framework makes it the natural home for institutional digital asset insurance.
Q5: What is the difference between a crime policy and a specie policy for digital assets?
A5: A crime policy covers losses from criminal acts — theft, fraud, and dishonest acts by employees or third parties. A specie policy is a type of property insurance designed for high-value, physically unique items (historically: precious metals, fine art, gems). For digital assets, crime policies cover theft and hacking scenarios. Specie policies may be applied to cover the physical media on which private keys are stored — hardware wallets, HSMs in vaults — against physical loss, destruction, or theft of the physical device. A comprehensive institutional digital asset programme typically combines elements of both: crime coverage for cyber theft and employee dishonesty, and specie-style coverage for physical key material. Understanding which coverage type responds to which scenario is essential when reviewing policy terms.
Conclusion
Digital asset insurance in 2026 is no longer a niche conversation for crypto-native firms. It is a standard institutional risk management question that affects every portfolio manager, corporate treasurer, family office, and exchange operator holding meaningful Bitcoin or other digital asset positions.
For institutional investors or businesses dealing with large amounts of Bitcoin, insurance is often a necessary risk management tool. It can provide the necessary assurance to stakeholders and regulators. The Lloyd's market has responded with genuine capacity — dynamic limit policies, dedicated crypto insurance cover holders, and bespoke institutional programmes up to $360 million per incident.
The underwriting process is rigorous because the risks are real and the losses are irreversible. Getting the custody architecture right — cold storage, multi-signature, regulatory oversight, geographic distribution — is both the best risk management practice and the clearest path to insurable coverage at competitive rates.
Bitcoin is now an institutional asset. Institutional assets require institutional risk management. That means custody, governance, and insurance working together.
Disclaimer: This article is for informational purposes only and does not constitute legal, financial, or insurance advice. Digital asset custody and insurance arrangements vary significantly. Consult a qualified specialist broker and legal adviser for advice specific to your institution.
.png)
Comments
Post a Comment