Log in Create an account
regulationsresearchdigital asset insuranceguidance documentClaims History & Loss Data

Claims History & Loss Data

June 4, 2026

27 min read

1. Major Loss Events Timeline

The digital asset industry has experienced a series of high-profile loss events since 2014. This section catalogues the most significant incidents, their magnitudes, whether insurance was involved, and the recovery mechanisms employed. These events collectively form the loss dataset upon which actuarial pricing, regulatory capital requirements, and coverage mandates must be built.

A recurring finding across every major incident below is that no centralised-exchange hack has been primarily resolved through a commercial insurance payout. Recovery has come from operator self-funding, venture capital, bankruptcy distribution, law-enforcement seizure, or — in one validated case — a mandatory-insurance scheme (

South Korea's VAUPA, Upbit Nov 2025). Loss and recovery figures drawn from exchange or aggregator disclosures are flagged as self-reported with their source.

1.1 Mt. Gox (February 2014) — ~$450 Million

Mt. Gox, then the world's largest Bitcoin exchange, suspended trading in February 2014 and filed for bankruptcy after disclosing the loss of approximately 850,000 BTC (~$450 million at the time). Approximately 200,000 BTC were later recovered in an old-format wallet, reducing total losses to ~650,000 BTC.

Insurance involvement: None. Mt. Gox held no known insurance coverage for digital asset theft. The exchange had no crime policy, no custody insurance, and no fidelity bond covering client assets.

Recovery mechanism: Creditor bankruptcy proceedings under Japanese law (

Japan). The Tokyo District Court approved a civil rehabilitation plan in 2021. Creditor repayments began in 2024 and continued thereafter. Recovery rates for creditors were substantially boosted by BTC price appreciation — creditors who held claims received repayment at BTC prices far exceeding the 2014 value, though at a significant discount to current market prices.

Sources:

1.2 Bitfinex (August 2016) — ~$72 Million

Bitfinex suffered a breach resulting in the theft of 119,756 BTC (~$72 million at the time). The exchange implemented a "socialized loss" mechanism, reducing all customer balances by 36% and issuing BFX tokens at a 1:1 ratio to USD losses.

Insurance involvement: None documented. Bitfinex did not carry digital asset theft insurance at the time of the breach, and no commercial insurance recovery occurred.

Recovery mechanism: BFX token redemption and equity conversion, later supplemented by US government seizure. Within eight months, all BFX tokens were redeemed at 100 cents on the dollar or converted to iFinex Inc. equity shares. Customers who converted to equity also received Recovery Right Tokens (RRT), redeemable at $1 per token upon fund recovery. In February 2022, the US Department of Justice (

United States) seized ~$3.6 billion in stolen Bitcoin (appreciated from the original $72 million); the government effected in-kind restitution of more than 94,000 BTC. Ilya Lichtenstein and Heather Morgan pleaded guilty to money laundering in August 2023. As of 2025, approximately 30 million RRT remained outstanding, pending full distribution of recovered assets.

Sources:

1.3 Coincheck (January 2018) — ~$530 Million

Japanese exchange Coincheck (

Japan) lost approximately 500 million NEM tokens (~$530 million) in what was at the time the largest single cryptocurrency theft. The hack exploited the fact that NEM holdings were stored in a hot wallet without multi-signature security.

Insurance involvement: None. Coincheck held no insurance covering digital asset theft. The exchange was not yet fully licensed by Japan's FSA at the time of the incident.

Recovery mechanism: Operator self-funded compensation. Coincheck announced it would repay all approximately 260,000 affected users in Japanese yen using its own capital — approximately USD 420 million — covering roughly 90% of losses. The exchange was subsequently acquired by Monex Group in April 2018 and continues to operate under full FSA licensing.

Regulatory consequence: The incident prompted the Japan FSA to issue business improvement orders to multiple exchanges and tighten registration requirements, ultimately leading to enhanced licensing frameworks for VASPs in Japan, including the 95% cold-storage standard now central to its regime.

Sources:

1.4 Poly Network (August 2021) — ~$611 Million

Cross-chain protocol Poly Network was exploited for over $611 million through a smart contract vulnerability. The attacker exploited the cross-chain relay function to authorize fraudulent transactions.

Insurance involvement: None documented.

Recovery mechanism: Full voluntary return by the attacker. The hacker began returning funds within 24 hours and completed the return within 15 days. Tether had frozen $33 million in USDT during the incident. Security researchers attributed the return to the difficulty of laundering funds when all transactions are visible on-chain. This incident is often cited as evidence that DeFi transparency can serve as a partial risk mitigant, though it should not be relied upon as a substitute for insurance.

Sources:

1.5 Ronin Bridge / Axie Infinity (March 2022) — ~$620 Million

North Korea's Lazarus Group compromised five of nine validator nodes on the Ronin bridge, siphoning 173,600 ETH and $25.5 million USDC (~$620 million total). The breach was not detected for six days.

Insurance involvement: None documented. Sky Mavis (Axie Infinity developer) did not hold insurance covering bridge exploits.

Recovery mechanism: Venture capital funding. Sky Mavis raised $150 million in a round led by Binance to reimburse victims. The Ronin bridge was relaunched in June 2022 with enhanced validator requirements. The US Treasury's OFAC sanctioned the associated Ethereum addresses. Only ~$5.7 million of the original stolen funds were directly recovered.

Sources:

1.6 FTX (November 2022) — Bankruptcy, ~$8.7 Billion Shortfall

FTX filed for Chapter 11 bankruptcy following revelations that customer funds had been commingled with Alameda Research. The shortfall was estimated at ~$8.7 billion.

Insurance involvement: Minimal and largely fabricated. FTX US held a crime policy through Aon with limits of only $7.5 million for tokens in hot or warm wallets. For cold wallet assets, FTX relied on BitGo custody insurance. FTX's publicly displayed "Insurance Fund" was fabricated — co-founder Gary Wang testified that he wrote code generating a random number to display as the fund balance. The FDIC issued a cease-and-desist order in August 2022 after FTX US misrepresented that customer deposits were FDIC-insured. Relm Insurance (Class IIGB,

Bermuda) had written policies exceeding $15 million for West Realm Shires (FTX.US) and FTX Australia (
Australia) and FTX-related companies, allocating reserves against known and unknown claims while committing to pay legitimate covered claims; ~95% of Relm's assets were held in cash and US Treasuries.

Recovery mechanism: Chapter 11 bankruptcy estate, supervised by CEO John J. Ray III. The plan identified ~$7 billion of recoverable assets and pays approximately 98% of creditors around 118% of their allowed claims at petition-date value. No meaningful insurance recovery occurred (fraud excluded). Sam Bankman-Fried was convicted of fraud and sentenced to 25 years.

Sources:

1.7 Euler Finance (March 2023) — ~$197 Million

DeFi lending protocol Euler Finance was exploited through a flash loan attack, draining approximately $197 million in stETH, wrapped Bitcoin, DAI, and USDC.

Insurance involvement: Partial. Euler had secured ~$10 million in insurance coverage from a DeFi insurance protocol — one of the few documented cases of DeFi-native insurance being in place before a hack. Sherlock, the audit firm that had reviewed Euler's contracts, paid a $4.5 million claim acknowledging it had missed the vulnerability. The combined ~$14.5 million is one of the few documented insurance-related payments following a major crypto incident.

Recovery mechanism: Negotiated return. The Euler Labs team engaged in a three-week recovery effort that resulted in the attacker returning all stolen funds. Due to ETH price appreciation during the recovery period, the returned value exceeded $240 million. This represents one of the most successful post-hack recovery efforts in DeFi history.

Sources:

1.8 Mixin Network (September 2023) — ~$200 Million

Hong Kong-based Mixin Network (

Hong Kong) lost approximately $200 million when attackers compromised its cloud service provider's database.

Insurance involvement: None documented.

Recovery mechanism: Operator-funded partial compensation. Founder Feng Xiaodong announced up to 50% immediate compensation to affected users, with the remainder converted to $153 million in bond tokens to be repurchased from company profits. Mixin offered a $20 million bounty for asset return; it remains unclaimed.

Sources:

1.9 DMM Bitcoin (May 2024) — ~$305 Million

Japanese exchange DMM Bitcoin (

Japan) lost 4,502.9 BTC (~$305 million) in what was later attributed to North Korea's Lazarus Group by US and Japanese law enforcement.

Insurance involvement: None documented. DMM Bitcoin did not carry theft insurance sufficient to cover the loss.

Recovery mechanism: Group company support. DMM Bitcoin's parent procured equivalent BTC through group companies — approximately USD 365 million — to make customer Bitcoin deposits whole. However, the operational and financial strain proved unsustainable: DMM Bitcoin announced its closure in December 2024, transferring accounts and assets to SBI VC Trade by March 2025.

Sources:

1.10 Bybit (February 2025) — ~$1.5 Billion

On 21 February 2025, North Korea's Lazarus Group stole approximately $1.5 billion in ETH from Bybit during a routine cold-to-hot wallet transfer. The attackers compromised a developer machine at multisig platform Safe{Wallet} to authorize a malicious transaction. This is the largest single cryptocurrency theft in history.

Insurance involvement: UNVERIFIED. No public documentation confirms that Bybit held traditional insurance covering this loss. Bybit did not disclose any insurance claim or payout.

Recovery mechanism: Emergency bridge financing and market operations. Bybit replenished reserves within roughly 72 hours via loans and emergency funding from Galaxy Digital, FalconX, and Wintermute — not insurance. A proof-of-reserves audit by Hacken confirmed 100%+ collateralisation was restored within days. Bybit offered a 10% bounty for return of stolen funds. The FBI attributed the attack to Lazarus Group (TraderTraitor).

Sources:

1.11 Upbit (November 2025) — ~$28 Million — First Validated Mandatory-Insurance Recovery

On a November 2025 incident, South Korean exchange Upbit (operated by Dunamu,

South Korea) lost approximately KRW 44.5 billion (~$28 million) in Solana-based tokens drained from a hot wallet over a 54-minute window.

Insurance involvement: Yes. This is the first publicly reported instance of a VAUPA-mandated insurance arrangement (combined with corporate reserves) being used to cover an exchange hack, validating South Korea's mandatory-insurance-or-reserve framework in practice. Specific insurance payout amounts were not publicly disclosed.

Recovery mechanism: All affected funds were restored through a combination of insurance and corporate reserves. Following the incident, Upbit increased cold-storage coverage to 95% of assets. An earlier Upbit incident (November 2019, 342,000 ETH, ~$50 million) had been covered by corporate funds with no insurance record.

Source: CryptoSlate, "$36 million Upbit hack revives the quiet truth about hot wallet insurance": https://cryptoslate.com/36-million-upbit-hack-revives-the-quiet-truth-about-hot-wallet-insurance/

1.12 Summary Timeline Table

YearIncidentJurisdictionAmount LostInsurance?Recovery MechanismRecovery Outcome
2014Mt. Gox
Japan		~$450MNoBankruptcy/rehabilitationPartial (boosted by BTC appreciation; repayments from 2024)
2016Bitfinex
US		~$72MNoSocialized loss + BFX tokens; DOJ seizure~100% token redemption; in-kind restitution >94,000 BTC
2018Coincheck
Japan		~$530MNoOperator self-funded (~$420M)~90% (JPY)
2021Poly Network— (DeFi)~$611MNoAttacker voluntary return~100%
2022Ronin Bridge— (DeFi)~$620MNoVC funding raise~100% (users made whole)
2022FTX
US		~$8.7B shortfallMinimal ($7.5M policy)Chapter 11 bankruptcy~$7B recoverable; ~98% of creditors ~118%
2023Euler Finance— (DeFi)~$197MPartial ($14.5M)Negotiated return~100%+ ($240M+ returned)
2023Mixin Network
Hong Kong		~$200MNoPartial operator compensation~50% immediate; remainder as bonds
2024DMM Bitcoin
Japan		~$305MNoGroup company support (~$365M); closureUsers transferred to SBI VC Trade
2025Bybit— (offshore)~$1.5BUNVERIFIEDBridge loans + emergency funding~100% (reserves restored ~72 hrs)
2025Upbit
South Korea		~$28MYes (VAUPA)Mandatory insurance + reserves~100% restored (first VAUPA-validated recovery)

Note: figures sourced from exchange/aggregator disclosures (Chainalysis, exchange statements, court filings) are self-reported. Loss and recovery amounts for Bybit insurance status remain UNVERIFIED; the ~$28M Upbit figure and ~99.7% Bithumb recovery below are industry-reported.

2. Aggregate Loss Data

2.1 Annual Theft Totals

Chainalysis, the leading blockchain analytics firm, provides the most comprehensive longitudinal data on cryptocurrency theft:

YearTotal StolenNumber of IncidentsNotable Trend
2020~$0.5B—DeFi summer begins
2021~$3.3B—DeFi exploits surge
2022~$3.7B—Bridge hacks peak (Ronin, Wormhole, Nomad)
2023~$1.7B—Decline from 2022 peak
2024~$2.2B (TRM Labs); ~$2.2B (Chainalysis)30321% YoY increase; North Korea: $1.34B (61%)
2025~$3.41B—Bybit alone: $1.5B (~44% of total); North Korea: $2.02B

In Q1 2026, crypto theft losses were ~$168.6 million, down ~88% YoY (self-reported / aggregator, preliminary).

Sources:

2.2 Loss by Attack Type

Based on Chainalysis 2024 data and industry reporting:

Private key compromise accounted for the largest share of stolen crypto in 2024 at 43.8%. This category includes insider theft, social engineering of key holders, and infrastructure compromise (as in the Bybit/Safe{Wallet} incident).

Attack type taxonomy for loss classification:

Attack CategoryDescriptionNotable Examples
Exchange hack (centralised)Compromise of exchange hot/cold walletsMt. Gox, Bitfinex, DMM Bitcoin, Bybit, Upbit, BingX
DeFi protocol exploitSmart contract vulnerability exploitationEuler Finance, Poly Network
Bridge hackCross-chain bridge validator or contract compromiseRonin Bridge, Wormhole, Nomad
Rug pull / exit scamDeliberate fraud by project operatorsVarious (smaller individual amounts)
Insider theft / fraudMisappropriation by authorised personnelFTX/Alameda
Cloud infrastructureCompromise of cloud service providersMixin Network
Operational errorErroneous distribution / keystroke errorBithumb (Feb 2026, ~620,000 BTC to 249 users)

Trend analysis (2024-2025): Centralised services became primary targets in Q2-Q3 2024 after DeFi protocols dominated in Q1 2024. In Q1 2025, centralised services accounted for 88% of losses. The ratio between the largest single hack and the median of all incidents crossed the 1,000x threshold for the first time in 2025, indicating extreme concentration risk in outlier events.

2.3 North Korean State-Sponsored Theft

The Democratic People's Republic of Korea (DPRK) represents a systemic risk factor unique to the digital asset sector. DPRK-affiliated groups (primarily Lazarus Group / TraderTraitor) accounted for:

  • 2023: $660.5 million across 20 incidents
  • 2024: $1.34 billion across 47 incidents (102.88% YoY increase)
  • 2025: $2.02 billion (51% YoY increase), cumulative all-time total: $6.75 billion

This concentration of losses in a single state-sponsored threat actor has no direct analogue in traditional insurance lines and presents unique challenges for underwriters. DPRK actors were implicated in the Ronin Bridge (

Japan-adjacent), DMM Bitcoin, Bybit, and Singapore's BingX incidents documented here.

3. Insurance Claims & Recovery Analysis

3.1 Documented Insurance Payouts

Documented cases of insurance actually paying out on digital asset claims remain extremely rare. The following represents the most significant known instances:

Euler Finance / Sherlock (2023): Audit firm Sherlock paid a $4.5 million claim to Euler Finance, acknowledging the audit had missed the exploited vulnerability. Separately, Euler held ~$10 million in DeFi-native protocol coverage. Combined, this ~$14.5 million represents one of the few documented insurance-related payments following a major crypto incident.

Relm Insurance / FTX-related entities (2022-2023,

Bermuda): Relm Insurance (Class IIGB) confirmed exposure exceeding $15 million through policies written for West Realm Shires (FTX US) and FTX Australia, as well as entities affected by the FTX collapse. Relm allocated reserves for known and unknown claims and committed to paying legitimate covered claims, holding ~95% of assets in cash/US Treasuries. The specific claim outcomes remain undisclosed.

South Korea Upbit (November 2025) — the strongest validated case: Following the $28 million November 2025 Solana-token theft, Upbit (Dunamu) restored all affected funds through a combination of VAUPA-mandated insurance and corporate reserves — the first publicly reported use of a mandatory crypto-insurance scheme to cover a hack. Upbit subsequently raised cold-storage coverage to 95% of assets. Specific insurance payout amounts were not publicly disclosed. An earlier 2019 Upbit ETH theft ($50 million) was covered by corporate funds with no insurance record.

South Korea Bithumb (February 2026) — operational error, not a hack: A keystroke error distributed ~620,000 BTC (~KRW 60 trillion nominal) to 249 users; approximately 99.7% was recovered (industry-reported). This was an operational-error recovery, not an insurance claim, but illustrates the role of post-incident clawback alongside insurance.

No comparable documented insurance payout exists for any other jurisdiction in this study. Bahrain, the UAE, Hong Kong, Singapore, Australia, Bermuda's wider book, Cayman, Canada, the EU member states, the UK, Switzerland, Liechtenstein, and the emerging markets report no jurisdiction-specific insurance claim/recovery data (NO DATA / NOT VERIFIED in the matrix), or — for Hong Kong's mandatory compensation arrangement — no loss event has yet tested the arrangement in practice as of June 2026.

3.2 Recovery Rates by Mechanism

Based on the major loss events documented above, recovery mechanisms and their typical effectiveness can be categorised:

Recovery MechanismTypical Recovery RateExamplesRegulatory Acceptability
Mandatory-scheme insurance + reserves~100% (1 validated case)Upbit Nov 2025 (VAUPA, South Korea)Highest — first real-world validation of a mandatory regime
Traditional commercial insurance payoutUNVERIFIED (insufficient data)Euler/Sherlock ($4.5M); Relm/FTX (undisclosed)Highest — preferred by regulators, but rarely tested
Attacker voluntary return~100% (when it occurs)Poly Network, Euler FinanceNot reliable; cannot be modelled
Operator self-funding50-100%Coincheck (~90%), Mixin (~50%), Bybit (~100%), BingXDepends on operator solvency
Group/parent company supportVariable; can exhaust operatorDMM Bitcoin (made whole, then closed)Depends on group solvency
VC / emergency funding~100% (for users)Ronin Bridge / Sky MavisAd hoc; not a regulatory safeguard
Socialized loss + token~100% (eventually)Bitfinex BFX tokensControversial; imposes losses on unaffected users
Operational clawbackVariable (~99.7% one case)Bithumb Feb 2026 keystroke errorDepends on counterparty cooperation
Bankruptcy distributionVariable; multi-yearMt. Gox, FTXSlowest; multi-year timelines
Law enforcement recovery<5% in most cases (higher with appreciation)Bitfinex (DOJ seizure, in-kind restitution)Unpredictable timing and amount

3.3 The Insurance Gap

The crypto insurance gap is stark:

  • Total digital asset market capitalisation: ~$3.31 trillion (as of early 2025)
  • Estimated total crypto insurance capacity: broker estimates vary widely — the global crypto insurance market is self-reported at ~$1.94 billion (2024, AM Best) rising to ~$9.49 billion (2025, broker figure); annual global GWP for dedicated digital-asset lines was estimated at ~US$150-300 million in 2024 (Howden). The largest single facility is Marsh's ~$825 million custody facility; the largest per-policy limit is Evertas/Arch up to ~US$420 million (2023, self-reported)
  • Insurance penetration: ~11% of crypto holders carry any form of coverage (AM Best, self-reported)
  • Demand signal: a substantial share of uninsured holders report willingness to purchase coverage

This means available dedicated capacity covers a fraction of a percent of total digital asset market value — orders of magnitude below the coverage ratios in traditional financial services. All capacity, premium, and per-policy figures above are self-reported by brokers/carriers and are not independently audited.

Sources:

4. D&O and E&O Claims in the Digital Asset Sector

4.1 D&O Claims Against Crypto Company Directors

Directors and officers of cryptocurrency firms face elevated litigation risk. Lawsuits target crypto company directors for breach of fiduciary duty, misrepresentation in whitepapers or investor materials, mismanagement of company funds, and failure to comply with securities laws.

FTX D&O Coverage Dispute: Following FTX's bankruptcy, Sam Bankman-Fried filed claims under four D&O insurance policies, each with a $5 million limit ($20 million total). Multiple FTX executives competed for coverage from the same limited pool, leading to disputes over allocation. The case illustrates the inadequacy of typical D&O limits for crypto companies, where a single failure can generate multi-billion-dollar liabilities.

Evertas D&O Product: Evertas, a Lloyd's-backed firm focused on crypto insurance, offers D&O coverage for digital asset companies up to $10 million, covering breach of duty lawsuits, regulatory investigations, and securities claims. In

Bermuda, Relm writes D&O alongside professional indemnity, crime, cyber, smart-contract-failure, and staking/slashing cover; in the UAE, VARA's four-category insurance regime expressly enumerates D&O as a required category.

Source: Evertas, "D&O Insurance for the Digital Assets Market": https://evertas.com/news/do-insurance-for-the-digital-assets-market-new-from-evertas/

4.2 E&O Claims Against Custodians and Exchanges

Errors and omissions claims against custodians and exchanges arise from alleged failures in security practices, inadequate disclosure of custody arrangements, and misrepresentation of insurance coverage (as in FTX's FDIC misrepresentation).

4.3 Landmark Court Decisions

Two

US court decisions have significantly shaped the intersection of insurance law and digital assets:

Sedaghatpour v. Lemonade Insurance Co. (4th Circuit, 2024): Ali Sedaghatpour lost ~$170,000 in cryptocurrency from a hot wallet hack and claimed under his Lemonade homeowners' policy. The Fourth Circuit affirmed the Eastern District of Virginia's ruling that cryptocurrency theft does not constitute "direct physical loss" as required by standard homeowners' policies. The court held that cryptocurrency "exists wholly virtually or digitally and has no physical or tangible existence" and therefore cannot suffer physical damage. Lemonade paid only $500 under an electronic fund transfer sub-limit.

Implication: Standard homeowners' and commercial property policies will not cover cryptocurrency losses absent explicit endorsement language. This ruling reinforces the need for bespoke digital asset insurance products.

Source: Insurance Journal, "Homeowners Insurance Does Not Cover Cryptocurrency Theft, 4th Circuit Affirms": https://www.insurancejournal.com/news/east/2024/10/29/798820.htm

Kimmelman v. Wayne Insurance Group (Ohio Common Pleas, 2018): James Kimmelman had ~$16,000 in Bitcoin stolen and claimed under his homeowners' policy. Wayne Insurance paid only $200 under a "money" sub-limit. The Ohio court ruled that Bitcoin constitutes "personal property" (not "money") under the policy, citing the IRS's 2014 treatment of virtual currency as property for federal tax purposes. The court denied the insurer's motion for judgment on the pleadings and allowed coverage and bad faith claims to proceed.

Implication: Cryptocurrency may be classified as "property" rather than "money" for insurance purposes, potentially triggering higher coverage limits. However, this trial-court ruling conflicts with the Fourth Circuit's physical-loss analysis in Sedaghatpour, creating jurisdictional uncertainty.

Sources:

5. Loss Ratios & Underwriting Performance

5.1 Digital Asset Insurance Loss Ratios

Comprehensive, publicly reported loss ratio data for digital asset insurance lines is not yet available. This data gap itself is a critical finding for regulators. Key observations:

  • Lloyd's syndicates participating in digital asset underwriting include Arch, Atrium, Beazley, and Canopius. Individual syndicate loss ratios for crypto-specific books are not published separately from aggregate results; Lloyd's claims-level data is confidential and not disclosed.
  • Specialty insurers such as Relm (Class IIGB,
    Bermuda    ) and Evertas (Lloyd's coverholder) do not publicly disclose loss ratios.
  • Munich Re has entered the market with comprehensive crime policies and staking insurance (notably as the domestic underwriting champion in
    Germany    ) but has not published crypto-specific loss experience.
  • Market capacity: Marsh's digital asset custody facility (DART) offers up to ~$825 million in capacity. Traditional carriers including AXA, AIG, and Chubb have been reported as active in the space.

5.2 Comparison to Traditional Lines

While crypto-specific loss ratios are unavailable, the structure of losses suggests:

  • Frequency: Low relative to traditional property/casualty lines, but increasing (303 incidents in 2024)
  • Severity: Extremely high per-event — average incident size of ~$7.3 million in 2024 ($2.2B / 303), with the top three events in 2025 accounting for 69% of all losses
  • Tail risk: The largest single event ($1.5 billion, Bybit 2025) exceeds even the higher self-reported estimates of dedicated annual capacity for the entire digital asset sector
  • Correlation: High; a single protocol failure, bridge exploit, or state-sponsored campaign can trigger multiple policy claims simultaneously

This pattern — low frequency, extreme severity, high correlation, fat tails — most closely resembles cyber catastrophe risk or natural catastrophe reinsurance rather than standard commercial crime.

Source: Chainalysis, "2025 Crypto Theft Reaches $3.4 Billion": https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/

6. Implications for Regulators

6.1 Minimum Coverage Level Calibration

The loss data yields several conclusions for regulators setting minimum insurance or reserve requirements:

  1. The MiCA minimum is inadequate for custody operations.

    EU MiCA Article 67 sets minimum own-funds requirements at EUR 50,000-150,000. Even the South Korean VAUPA minimum of KRW 3 billion (~USD 2.2 million) for KRW-market exchanges would have been trivial relative to any of the major incidents documented here.

  2. Percentage-of-assets models are more responsive. South Korea's 5%-of-hot-wallet requirement and

    Hong Kong SFC's 100%-hot / 50%-cold compensation-arrangement requirement are structurally better suited to the scale of digital asset risks, though the 5% figure may itself be insufficient for correlated events.

  3. Only one exchange hack has been resolved through a mandatory-insurance scheme. The November 2025 Upbit restoration (VAUPA insurance + reserves) is the single validated case; every other major recovery has relied on operator self-funding, parent-company support, venture capital, bankruptcy distribution, or law enforcement — not commercial insurance payouts. Regulators should treat the Upbit case as proof of concept, not proof of sufficiency.

6.2 Frequency vs. Severity Patterns

  • Frequency is increasing: 303 incidents in 2024, up from prior years
  • Severity is concentrating: The top 3 events account for the majority of annual losses
  • State-sponsored theft dominates: DPRK-linked actors are responsible for 44-61% of annual theft value
  • Recovery is unpredictable: Voluntary returns (Poly Network, Euler) are fortunate outliers, not a reliable recovery mechanism; mandatory-scheme insurance (Upbit) has worked once but remains untested at large scale

6.3 Market Cycle Correlation

Loss events do not correlate neatly with market cycles. While the 2021-2022 bull market saw the highest absolute losses, the 2024-2025 data shows that theft continues and accelerates during all market conditions. State-sponsored actors, in particular, are insensitive to market sentiment.

6.4 Key Recommendations

  1. Mandate disclosure of insurance arrangements as a condition of VASP licensing, including policy limits, exclusions, and identity of underwriters
  2. Require segregation of insurance proceeds from operational assets to prevent commingling (as occurred at FTX)
  3. Establish minimum loss-data reporting requirements for licensed VASPs to build the actuarial dataset needed for accurate pricing
  4. Recognise the insurance gap as a systemic risk and consider whether public-sector backstops or mandatory mutual insurance pools are needed for the largest potential events
  5. Study the Upbit/VAUPA precedent as the one operating example of mandatory crypto insurance functioning as designed, while recognising it covered a ~$28M loss — two orders of magnitude below the largest tail events

Verification Notes

This is a refresh synthesis mirroring the t5 (notable events / recovery outcome) fields of the canonical per-jurisdiction fact matrix across all 18 jurisdictions in this study, with the latest verified facts as of 2026-06-04. No new web searches were conducted for this refresh; the fact matrix is the verified source of truth. Underlying loss figures, incident dates, and recovery mechanisms were originally verified through web research, with sources including Chainalysis research reports, major financial news outlets (CNBC, CoinDesk, TechCrunch, Fortune), court-record summaries (Insurance Journal, Hunton Andrews Kurth), and official company/regulator statements. Where insurance involvement could not be confirmed through public sources, it is marked "None documented," "UNVERIFIED," or "NO DATA."

Jurisdiction coverage (18): United States, Bermuda, Canada, Cayman Islands (Americas); Australia, Hong Kong, Japan, Singapore, South Korea (Asia-Pacific); European Union, France, Germany, Liechtenstein, Switzerland, United Kingdom (Europe); Bahrain, Emerging Markets (Brazil/Nigeria/South Africa/India), United Arab Emirates (Middle East & Africa).

Key refresh corrections this cycle:

  • Upbit Nov 2025 added as the first validated VAUPA mandatory-insurance + reserves recovery (~$28M Solana tokens; cold storage raised to 95%); Bithumb Feb 2026 ~620,000 BTC keystroke error ~99.7% recovered (industry-reported).
  • Bybit insurance status remains UNVERIFIED; reserves replenished within ~72 hours via bridge loans, not insurance.
  • FTX recovery restated to ~$7B recoverable assets, plan paying ~98% of creditors ~118% of allowed claims; Relm exposure >USD 15M to West Realm Shires (FTX.US) and FTX Australia.
  • Bitfinex recovery restated to include DOJ seizure with in-kind restitution >94,000 BTC.
  • Coincheck ($420M operator self-funding) and DMM Bitcoin ($365M parent support, then closure) recovery figures aligned to the matrix.
  • N recomputed for N=18 throughout; "only one exchange hack resolved via mandatory insurance" now reflects the Upbit precedent rather than a blanket "none."

Self-reported figures (not independently audited), flagged in-text: crypto insurance market size (~$1.94B 2024 / ~$9.49B 2025), annual GWP (US$150-300M, Howden 2024), Marsh custody facility ($825M), Evertas/Arch per-policy limit (~US$420M), ~11% penetration (AM Best), ~$28M Upbit loss, ~99.7% Bithumb recovery, all annual theft totals (Chainalysis/TRM Labs).

Limitations:

  • Lloyd's syndicate-level loss ratio data for digital asset books is not publicly available (confidential).
  • Exact insurance payout amounts for the Upbit incidents are not publicly disclosed.
  • Relm Insurance FTX claim outcomes are not publicly confirmed.
  • Hong Kong's mandatory compensation arrangement has not yet been tested by a loss event (young regime since June 2023).
  • Bahrain, the UAE, Cayman, Canada, Australia, Switzerland, Liechtenstein, France, Germany, the EU (aggregate), and the emerging markets report no jurisdiction-specific insurance claim/recovery data in the matrix (NO DATA / NOT VERIFIED).
Graph view