Log in Create an account
regulationsresearchdigital asset insuranceguidance documentCoverage Gaps & Exclusions

Coverage Gaps & Exclusions

June 4, 2026

39 min read

Last Updated: June 2026

1. Standard Exclusions in Digital Asset Insurance Policies

Nearly all commercial insurance policies written for digital asset businesses contain a core set of exclusions that materially limit the scope of protection. These exclusions reflect the insurance industry's incomplete understanding of blockchain-specific risks, the absence of actuarial loss data in many categories, and deliberate risk selection by underwriters. Regulators designing mandatory insurance requirements must understand these exclusions to avoid creating regimes where nominal "insurance" provides inadequate actual protection.

The following exclusions appear across the majority of policies surveyed from licensed carriers in the Lloyd's, Bermuda, and surplus-lines markets.

1.1 Smart Contract Bugs and Vulnerabilities

Traditional insurance policies — including cyber liability, crime, and professional indemnity — universally exclude or fail to cover losses arising from smart contract code errors. As Founder Shield's analysis documents, "smart contract exploits where any loss from code errors or vulnerabilities in smart contracts is typically not covered by traditional insurance policies." Cyber policies are designed to protect data; crypto assets are generally classified as money, creating a fundamental mismatch in coverage classification.

Even purpose-built digital asset policies from specialist underwriters typically exclude smart contract risk unless a specific endorsement is purchased. Where "smart contract failure liability" coverage exists, it remains a niche product with limited capacity and significant sublimits. A handful of regulated carriers now write it explicitly — Munich Re's Smart Contract Risk Insurance in

Germany is the clearest example of a regulated commercial product covering smart-contract failure — but such products are the exception, not the market norm.

Regulatory implication: Any mandatory insurance regime that does not explicitly address smart contract risk will leave the most common DeFi attack vector uncovered.

Sources:

1.2 Protocol-Level Failures

Losses caused by consensus bugs, chain reorganizations, finality failures, or base-layer protocol vulnerabilities are excluded from all known commercial policies. These are treated as systemic infrastructure risks analogous to electrical grid failures or internet backbone outages — events that underwriters consider uninsurable at the individual policy level due to catastrophic aggregation exposure.

The February 2025 Bybit hack (~$1.5 billion in ETH, the largest single theft on record), while attributed to a compromised signing process rather than a consensus failure, nonetheless exposed the fragility of reliance on protocol-level security assumptions. Bybit covered its loss through emergency bridge loans and reserve replenishment (reserves restored within roughly 72 hours) rather than insurance payouts, demonstrating the absence of coverage at this scale.

Sources:

1.3 Regulatory Action Losses

Asset freezes, sanctions-related seizures, enforcement actions, and losses arising from compliance failures (AML/KYC deficiencies, unauthorized token offerings) are excluded from digital asset insurance policies. This exclusion mirrors traditional financial services insurance, where regulatory fines and penalties are generally uninsurable as a matter of public policy. However, the exclusion extends further in the digital asset context because regulatory uncertainty itself creates ambiguity about whether a given activity is lawful.

The FDIC's issuance of cease-and-desist orders to nine entities in 2022-2023 for falsely implying FDIC coverage of crypto products illustrates the regulatory risk that remains wholly uninsured. That ambiguity has if anything sharpened: the SEC and CFTC issued a binding joint crypto-asset interpretation with a five-part token taxonomy on 17 March 2026 (SEC Release 33-11412 / CFTC PR 9198-26), reallocating which activities fall under which regulator — a reclassification that itself can render a previously-compliant activity newly non-compliant, with no insurance response.

Sources:

1.4 Key Compromise Through Social Engineering

Social engineering attacks — phishing, SIM-swapping, deepfake impersonation — that lead to private key compromise are either explicitly excluded or subject to severe sublimits in most policies. The classification challenge is acute: insurers treat these as "voluntary parting" (the authorized signatory willingly executed the transaction, even if deceived) rather than theft, which triggers crime policy exclusions.

The Bybit hack itself involved social engineering compromise of a third-party signing process, where the Lazarus Group manipulated the multi-signature approval workflow. This type of attack sits in an ambiguous zone between covered theft and excluded voluntary parting, a classification dispute that would likely require litigation to resolve.

Sources:

1.5 Nation-State Attacks

Since Lloyd's Bulletin Y5381 (effective March 31, 2023), all standalone cyber policies in the Lloyd's market must include explicit exclusions for state-backed cyber operations. The updated LMA model clauses (replacing earlier LMA5564-5567) carve out large-scale, state-linked cyber operations by reference to actor identity, scale and effect, geographic scope, and attribution mechanics. The "A" versions of these clauses require formal attribution by a "competent authority," while "B" versions omit attribution requirements entirely.

This exclusion has direct and severe consequences for the digital asset sector. North Korean state-affiliated hackers (Lazarus Group) stole $2.02 billion in cryptocurrency in 2025 alone — a 51% year-over-year increase — bringing their cumulative all-time total to $6.75 billion. The Bybit hack (~$1.5 billion) was attributed to Lazarus Group. Under most current policy wordings, these losses would fall within the nation-state exclusion if attribution is established.

The practical effect: the single largest category of crypto theft losses is potentially excluded from insurance coverage entirely.

Sources:

1.6 Market Value Depreciation During Claim Process

No known commercial policy covers the depreciation of crypto asset value between the time of loss and the time of claim settlement. Given the extreme volatility of digital assets — Bitcoin dropped from an all-time high above $120,000 to approximately $60,000 in early 2026 before recovering to ~$70,000 — the gap between time-of-loss valuation and settlement valuation can represent a material portion of total economic harm.

Claims are typically settled in fiat currency, but the timing of valuation conversion remains contentious. Whether the insured amount reflects the value at the moment of theft, at the time of reporting, or at the time of settlement is a policy-specific determination that frequently generates disputes.

Sources:

1.7 DeFi Protocol Impermanent Loss

Impermanent loss — the divergence in value between holding assets in a liquidity pool versus holding them outright — is universally excluded from traditional commercial policies. Some DeFi insurance protocols (e.g., Bancor's Impermanent Loss Protection) have offered parametric-style coverage for this risk, but these are protocol-specific mechanisms rather than insurance products in the regulatory sense.

Traditional underwriters do not recognize impermanent loss as an insurable event because it represents an inherent economic characteristic of automated market maker design rather than an external peril.

1.8 Rug Pulls and Governance Attacks

Rug pulls — where project founders attract investment then abandon the project, draining liquidity — are explicitly excluded from both traditional and most DeFi insurance products. As Three Sigma's analysis confirms, "a cover will most likely not cover rug pulls."

Governance attacks occupy a more nuanced position. Nexus Mutual's Protocol Cover does include governance attacks as a covered peril, alongside smart contract hacks, oracle attacks, and severe economic design failures. However, Nexus Mutual is a UK discretionary mutual whose members have no contractual obligation to pay claims — not a regulated insurer — so its cover provides no regulatory protection equivalent to a licensed policy. Traditional commercial insurance policies do not cover governance manipulation losses at all.

Sources:

1.9 MEV and Front-Running Losses

Maximal Extractable Value (MEV) extraction — including sandwich attacks, front-running, and back-running — has caused over $1 billion in cumulative losses to DeFi users. These losses fall entirely outside insurance coverage. MEV represents transaction-ordering manipulation rather than a security breach, theft, or code vulnerability, placing it in a category that no existing insurance product addresses.

No known commercial insurer or DeFi insurance protocol offers coverage for MEV-related losses as of June 2026.

1.10 War, Terrorism, and Nuclear Exclusions Applied to Cyber

Standard war, terrorism, and nuclear/biological/chemical/radiological (NBCR) exclusions in property and casualty policies apply equally to digital asset losses. The interaction between these legacy exclusions and the newer Lloyd's nation-state cyber exclusions creates layered exclusion zones. A state-sponsored cyberattack on digital asset infrastructure could trigger both the war exclusion in underlying property/crime policies and the nation-state exclusion in cyber policies, leaving no responsive coverage.

The NotPetya settlements (Merck, Mondelez, 2022-2024) demonstrated that legacy "war" wording in property policies was too narrow to exclude cyber operations. However, the new explicit cyber-war clauses adopted post-Y5381 are far more specific and are likely to be upheld.

Sources:

2. The Protection Gap — Quantified

The gap between the digital asset industry's exposure to loss and the insurance capacity available to absorb those losses is one of the most significant unresolved risk management challenges in financial services. This section quantifies the gap across multiple dimensions.

2.1 Market Capitalization vs. Insured Amount

MetricValueSource
Global crypto market capitalization (2025)~$3.31 trillionRisk & Insurance (2025)
Insurance penetration rate (holders insured)~11%AM Best / GlobalData survey (self-reported)
Estimated insured value as % of market cap~1%Risk & Insurance (2025)
Traditional financial sector insurance penetration>6%Risk & Insurance (2025)
Uninsured holders willing to purchase coverage42%GlobalData Emerging Trends Survey 2024
Uninsured holders open to considering coverage26%GlobalData Emerging Trends Survey 2024

The ~1% insurance penetration rate for crypto assets compares unfavorably to virtually every other asset class. The ~11% figure represents the share of cryptocurrency holders with any form of insurance (self-reported, AM Best / GlobalData) — not the share of asset value covered, which is substantially lower.

Sources:

2.2 Annual Losses vs. Insurance Capacity

YearTotal Crypto Theft/Hack LossesAvailable Insurance Capacity (est.)Gap Multiple
2024~$2.2 billion~$1-2 billion (total market capacity)1-2x
2025~$3.4 billion~$2-3 billion (total market capacity)1.1-1.7x

The largest single facility as of 2026 is the Marsh Digital Asset Risk Transfer (DART) facility, providing cover up to $825 million for digital asset custodians (launched March 2024). Evertas, the dedicated crypto insurer operating as a Lloyd's coverholder (Arch lead capacity), offers per-policy limits of up to $420 million for custodial assets (self-reported, 2023; a widely-cited $500 million/2025 figure remains unconfirmed). AnchorWatch (a Lloyd's coverholder) reports a binding authority of up to $500 million per customer for bitcoin (self-reported). These per-policy limits are all self-reported by the providers and remain materially below single-incident exposure.

Annual theft losses in 2025 exceeded total available insurance market capacity. Even if every dollar of capacity were deployed and every claim paid in full, the industry could not have absorbed the year's losses. The Bybit hack alone (~$1.5 billion) exceeded any single policy limit available in the market.

Sources:

2.3 Gross Written Premium vs. Need

The estimated GWP for digital asset insurance lines is $150-300 million (CII/London Market and Howden estimate, 2024). By comparison, the global cyber insurance market exceeded $20 billion GWP in 2025.

To contextualize the inadequacy: if digital asset insurance GWP were $300 million and the loss ratio were 100% (every premium dollar paid out as claims), the industry could absorb only ~8.8% of 2025's ~$3.4 billion in theft losses.

Sources:

2.4 Gap Trajectory — Widening or Narrowing?

Evidence is mixed but tilts toward a widening gap in absolute terms:

Factors widening the gap:

  • Crypto market capitalization has grown faster than insurance capacity
  • Theft losses accelerated through 2025 (~$2.2B in 2024, ~$3.4B in 2025), although early-2026 data is softer (self-reported aggregator figures put Q1 2026 theft at ~$169 million, down sharply year-over-year)
  • Nation-state exclusions removed the largest loss category from coverage
  • Lloyd's war exclusion clauses (Y5381/Y5433) have reduced the scope of recoverable claims

Factors narrowing the gap:

  • Marsh DART $825M facility (2024) significantly increased single-facility capacity
  • Lloyd's syndicates (Arch, Atrium, Beazley, Canopius) and traditional carriers (AXA, AIG, Chubb) are expanding crypto underwriting
  • Bermuda's
    dedicated innovative classes     (Relm, Class IIGB/IILT) and
    Germany's     Munich Re are deepening regulated supply
  • Regulatory mandates in
    Hong Kong     and
    South Korea     are forcing capacity development

Assessment: The relative protection gap (insured percentage of total exposure) remains largely static at approximately 1%. The absolute gap continues to widen as market capitalization outpaces capacity growth, even where year-over-year loss frequency fluctuates.

3. Structural Coverage Limitations

Beyond specific exclusions, several structural features of the digital asset ecosystem create coverage limitations that cannot be resolved through policy wording alone.

3.1 Aggregation Risk and Correlated Losses

The digital asset ecosystem exhibits extreme loss correlation. A vulnerability in a widely-used smart contract library (e.g., OpenZeppelin), a consensus bug in a major Layer 1, or a compromise of a dominant custodian could trigger simultaneous claims across dozens or hundreds of policyholders. This aggregation risk is the primary reason insurers maintain low per-policy limits and restricted total capacity.

As the Casualty Actuarial Society documented in its 2024 framework paper, "cyber risks may become highly correlated among various protocols, and these interconnections inevitably lead to the accumulation of systemic risks throughout the insurance portfolios of digital asset insurers, which can place a significant strain on their solvency."

The Bybit incident illustrated this in practice: while only one exchange was breached, the systemic shock triggered market-wide withdrawal pressure and liquidity stress across multiple platforms.

Sources:

3.2 Valuation Disputes

Digital asset valuation is inherently contentious in an insurance context. Key disputes include:

  • Time-of-loss determination: Blockchain transactions are timestamped, but the "time of loss" may differ from the time of detection (the Ronin Bridge hack in March 2022 went undetected for six days)
  • Price source selection: Asset prices vary across exchanges; no universally accepted oracle or price feed exists for insurance valuation purposes
  • Stale pricing: For illiquid tokens, the last traded price may not reflect realizable value
  • Portfolio vs. individual asset valuation: A theft of multiple token types creates compound valuation challenges

The early 2026 crypto market correction (Bitcoin declining from >$120,000 to ~$60,000) generated a wave of valuation disputes, as Kennedys Law documented: "Sharp market movements tend to crystallise disputes that were previously latent."

Sources:

3.3 Attribution Challenges

Determining the proximate cause of a digital asset loss is frequently ambiguous. A loss may involve multiple contributing factors — a smart contract vulnerability exploited via a social engineering attack using a nation-state-developed tool. Each element potentially triggers different policy provisions, different exclusions, and different coverage outcomes.

The Lloyd's nation-state attribution framework illustrates the challenge: the "A" version model clauses require a "competent authority" to attribute the attack to a state actor before the exclusion applies, but what constitutes sufficient evidence and who qualifies as a competent authority remain subject to dispute. In the crypto context, blockchain analytics firms (Chainalysis, Elliptic, TRM Labs) frequently provide attribution, but their assessments do not carry the legal weight of government attribution.

3.4 Cross-Chain Risk and Bridge Exploits

Cross-chain bridge exploits represent one of the most significant uninsured risk categories. The loss record is severe: Ronin Bridge ($620 million, March 2022), Wormhole ($320 million, February 2022), Nomad ($190 million, August 2022), and numerous smaller incidents.

Bridge exploits create acute coverage questions:

  • Which chain's policy responds? Assets may be locked on Chain A while synthetic assets are minted on Chain B
  • Which entity is the insured? The bridge protocol, the sending chain, the receiving chain, or the end user?
  • Is the loss theft or smart contract failure? Classification determines which policy line (crime vs. tech E&O) responds
  • Sub-custodian chains: Assets may pass through multiple custodial layers before reaching a bridge, and each hop may involve different insurance coverage (or none)

No standard market wording adequately addresses multi-chain loss scenarios. This is a material gap that actuarial models have not yet resolved.

Sources:

3.5 Custody Chain Gaps

Modern institutional custody frequently involves chains of delegation: an exchange uses a technology custody provider, which may use a hardware security module vendor, which may sub-delegate key management to a cloud HSM service. Each link in the custody chain may carry different insurance, different policy limits, and different exclusion sets.

When a loss occurs, determining which entity's policy responds — and whether the loss falls within the covered perils of that specific policy — requires tracing the custody chain and mapping each entity's obligations. Gaps between overlapping policies (where each insurer argues the other should respond first) create practical coverage voids.

3.6 Hot Wallet vs. Cold Wallet Coverage Limits

The insurance market draws a sharp distinction between hot wallet and cold wallet coverage. Cold storage assets benefit from significantly higher available limits (the Marsh DART $825 million facility and consortia such as Marsh Blue Vault, ~$150 million, specifically target cold storage and MPC-secured assets). Hot wallet coverage is severely capacity-constrained, with typical limits ranging from $5-50 million.

This bifurcation reflects the actuarial reality that hot wallets are more vulnerable to remote attack, but it creates operational tension: exchanges and custodians must maintain some hot wallet balances for liquidity and operational purposes. The coverage gap between hot wallet exposure and available limits is one of the most acute practical challenges facing digital asset businesses — and it is precisely the gap that the prescriptive Asia-Pacific mandates (

Hong Kong 100% hot,
South Korea ≥5% hot) and the voluntary-but-encouraged ~10% hot-wallet cover in
Singapore are each trying, with very different force, to close.

4. Jurisdiction-Specific Gaps

This section synthesises the coverage gaps implied across all 18 jurisdictions in the matrix (the United States, Bermuda, Canada, the Cayman Islands; Australia, Hong Kong, Japan, Singapore, South Korea; the European Union, France, Germany, Liechtenstein, Switzerland, the United Kingdom; Bahrain, the United Arab Emirates, and an Emerging Markets cluster of Brazil, Nigeria, South Africa and India). The pattern is consistent: even where insurance is mandatory, the mandate covers only part of the exposure; where it is voluntary, the gap is structural; and almost everywhere, deposit-guarantee schemes leave retail holders unprotected against the underlying asset risk.

4.1 Where Mandated Insurance Is Insufficient

Hong Kong — SFC Compensation Arrangement (50% Cold / 100% Hot):

The SFC's VATP Guidelines require licensed platforms to maintain a compensation arrangement covering 50% of client virtual assets in cold storage and 100% of client virtual assets in hot/online storage as a licensing condition. Acceptable arrangements include third-party insurance, dedicated/reserved virtual assets, demand/time deposits, or bank guarantees from authorized Hong Kong financial institutions, subject to SFC approval.

The 50% cold storage threshold was a deliberate compromise — the SFC reduced an original proposal of higher coverage in view of the significant costs of maintaining insurance or other compensation arrangements. While at least 98% of client assets are required to be in cold storage, the 50% coverage cap means that in a worst-case scenario (total cold storage compromise), clients could face a 50% loss on the majority of their holdings. As of May 2026 there were 13 licensed VATPs (most recently NewBX Limited / Bixin.com, 18 May 2026), and no loss event has yet tested the compensation arrangements in practice.

Gap analysis: Hong Kong's regime is the most prescriptive globally but still leaves up to 50% of cold-stored assets uninsured. For a major platform holding $10 billion in cold storage, $5 billion would be uncovered by the mandatory arrangement. The Insurance Authority's 8 May 2026 RBC consultation conclusions (a 100% downward stress factor on insurers' direct crypto holdings, with no diversification benefit, implementation targeted 31 Dec 2026 pending LegCo negative vetting) signal that even as domestic insurer capacity is unlocked, it will be capital-expensive — a structural brake on closing the 50% gap quickly.

Sources:

South Korea — VAUPA ≥5% Hot-Wallet Floor:

South Korea's VAUPA mandates liability insurance or equivalent reserves covering at least 5% of the value of customer virtual assets in hot wallets (KRW 3 billion minimum for KRW-market exchanges; KRW 500 million for coin-only exchanges and wallet/custodians), alongside an 80% cold-storage minimum. The 5% floor is, by design, a thin slice of total exposure. The framework was validated in practice — the November 2025 Upbit hack (~KRW 44.5 billion / ~USD 28 million in Solana tokens, drained in 54 minutes) was the first publicly reported case of VAUPA-mandated insurance and reserves being used to fully restore user funds — but the gap remains: the mandatory floor covers only hot-wallet exposure, and bank-style no-fault liability remains PROPOSED, not enacted (a central feature of the second-phase DABA bill introduced 8 April 2026, with review pushed into H2 2026). Until then, exchanges are not legally obligated to compensate users unless negligence is proven.

Bahrain and the
United Arab Emirates — Prescriptive but Capacity-Constrained:

Bahrain mandates PII (minimum BHD 100,000 ≈ USD 265,000), keyman, and cybersecurity insurance for all CRA licensees — quantified and prescriptive — yet no Bahraini insurer offers a dedicated digital asset product, so specialty risk must be placed internationally, and local specialty capacity is very limited. The UAE imposes mandatory insurance across VARA (four categories, including commercial crime for hot wallets), ADGM FSRA (PII) and DFSA (PII + cyber), but on a principles-based adequacy standard with no prescribed minimum amounts; DeFi-protocol-exploit and smart-contract-failure cover is explicitly emerging/limited even though Federal Decree-Law No. 6 of 2025 (Article 62) brings DeFi within the regulatory perimeter. In the Emerging Markets cluster, Nigeria mandates a fidelity bond (≥25% of minimum paid-up capital) plus user-asset insurance with no minimum, but there is no local capacity to satisfy it.

Canada and the
Cayman Islands — Mandatory in Substance, No Numeric Floors:

CIRO's February 2026 tiered custody framework makes fidelity (crime/financial-institution bond) and specie (cold-storage) insurance a gating factor for CTP custodian-tier approval — mandatory in substance — but prescribes no minimum coverage amounts, and no major Canadian insurer has launched a dedicated digital asset line, leaving reliance on global specialty markets. Cayman's February 2026 Market Conduct RSOG (MC-RSOG) prescribes insurance categories (professional liability, theft/loss of client assets, business interruption, cybersecurity) on an "insure-or-mitigate" basis with no numeric minimums — a direct response to CIMA's finding that 82% of reviewed VASPs lacked any cybersecurity insurance. The first full Cayman VASP licence was issued to BCXPro (JMSC Trading) on 5 February 2026.

4.2 Where No Specific Insurance Mandate Exists

The following major jurisdictions impose no specific insurance or compensation requirement on digital asset service providers, leaving the entire commercial-policy exclusion set (Section 1) as an uncovered residual:

  • Singapore    :     MAS requires trust-account segregation and 90% cold storage (PS-G03) but does not mandate insurance; insurance is not even listed as an alternative safeguarding method. Firms voluntarily insure roughly their ~10% hot-wallet exposure. As of 4 June 2026, 37 Major Payment Institutions are licensed for DPT-service activity. The April 2026 MAS prudential consultation was banking-focused and added no insurance mandate.
  • Japan    :     No standalone insurance mandate under the current PSA (user protection rests on segregation, 95% cold storage and annual audits). The FIEA amendment bill, Cabinet-approved 10 April 2026 (penalty for unregistered operation raised to 10 years / JPY 10 million), would introduce mandatory pre-funded liability reserves with approved insurance able to count toward part of the reserve — but that regime is not expected to take effect until around FY2027, and the insurance-as-reserve detail is not yet finalized.
  • United States    :     No federal or state insurance mandate exists for crypto custodians or exchanges; coverage is market-driven through the surplus-lines (non-admitted) market. The GENIUS Act (enacted 18 July 2025) established a stablecoin framework, and the FDIC's 7 April 2026 NPR (FIL-11-2026, comments due 9 June 2026, proposed not final) makes explicit that stablecoin reserves are NOT pass-through insured. No NAIC model law or digital-asset-insurance working group was advanced at the Spring 2026 National Meeting.
  • United Kingdom    :     The new cryptoasset regime (SI 2026/102, made 4 February 2026, in force 25 October 2027) imposes conduct and resilience requirements and CASS-17-style safeguarding (CP26/4) but introduces no insurance mandate; custodian insurance remains voluntary, and FSCS continues to exclude crypto.
  • Australia    :     The Digital Assets Framework Act 2026 (Royal Assent 8 April 2026, commencing 9 April 2027 with a 6-month transition) brings Digital Asset Platforms and Tokenised Custody Platforms under the AFSL regime — which requires only adequate professional-indemnity insurance — and prescribes no crypto coverage ratio. AML/CTF obligations commenced for existing reporting entities (incl. existing DCEs) on 31 March 2026, with tranche-2 new sectors from 1 July 2026.
  • Switzerland    :     No statutory insurance mandate; FINMA Guidance 01/2026 relies on bankruptcy-proof segregable custody plus operational/cyber controls, with insurance optional. Retail protection remains a gap.
  • The
    European Union    ,
    France    ,
    Germany     and
    Liechtenstein    :     MiCA Art. 67 permits insurance as an alternative to own funds — elective, not mandatory — so a CASP can satisfy its prudential safeguard entirely with capital and carry no insurance at all. The MiCA transitional period ends 1 July 2026 (and the French DASP / Liechtenstein TT-provider transition likewise ends 1 July 2026, with TT providers required to obtain MiCAR authorisation by that date). EIOPA's 100% crypto capital stress (March 2025 technical advice) is still pending a subsequent delegated act and is not yet enacted — the adopted Solvency II Delegated Regulation (EU) 2026/269 (OJ 18 February 2026, in force 10 March 2026) contains no crypto-specific charge.

4.3 Where Deposit Guarantees Explicitly Exclude Crypto

Of the 18 jurisdictions, 13 operate a deposit-guarantee or investor-compensation scheme that addresses crypto coverage; every one of those 13 excludes unbacked crypto-assets from coverage (BTC, ETH and the like). The remaining 5 — Bermuda, the Cayman Islands, Bahrain and the Emerging Markets cluster — have no deposit-guarantee scheme covering digital assets, relying instead on segregation/insurance mandates, while the UAE operates a distinct VARA ETD Insurance Fund (a default-protection buffer for exchange-traded-derivatives, not a deposit guarantee). Only one jurisdiction — Liechtenstein — extends any scheme protection to a tokenised instrument (security tokens, see §4.4). This creates a consumer protection gap, as survey evidence suggests many retail participants mistakenly believe their holdings carry government-backed protection. See Deposit Guarantee Schemes for the full scheme-by-scheme analysis.

SchemeJurisdictionCrypto CoverageKey Details
FSCSUnited KingdomExcludedDoes not cover cryptoasset losses, even under the new 2027 regime (SI 2026/102); applies to insurer failure, not the underlying asset
FDICUnited StatesExcludedCrypto not covered; April 2026 NPR (FIL-11-2026) bars pass-through insurance for stablecoin reserves
SIPCUnited StatesExcludedDoes not protect non-security crypto (BTC/ETH) or unregistered crypto-asset securities
DGS / ICSEuropean UnionExcludedEUR 100,000 deposit / EUR 20,000 investor guarantee does not extend to crypto; tokenised deposits may qualify (EBA Dec 2024)
FGDRFranceExcludedCrypto-assets explicitly excluded; only euro/official-currency products covered
EinSiG / AnlEntGGermanyExcludedBaFin confirms crypto not covered; tokenised securities (eWpG) may qualify for investor compensation
esisuisseSwitzerlandExcluded"Credit balances not held in a government-issued currency (e.g. units of cryptocurrencies) are explicitly excluded" — all crypto excluded
CDIC / CIPFCanadaExcludedCDIC excludes crypto (incl. stablecoins); CIPF excludes direct crypto, covers only cash and crypto ETFs/fund units
KDICSouth KoreaExcludedCrypto on exchanges not covered (KDIC now has data-access authority for asset tracing)
DICJJapanExcludedCrypto classified as "property value," not deposits under the Banking Act
SDICSingaporeExcludedSGD 100,000 guarantee applies to SGD bank deposits only; DPT providers are not members
FCS / NGFAustraliaExcludedCrypto platforms are not ADIs; digital assets are not deposits; non-ASX crypto not covered by NGF
EAS (PCC)LiechtensteinPartialSecurity tokens eligible for investor compensation up to CHF 30,000; unbacked crypto (BTC/ETH) and institutional clients excluded

Sources:

4.4 The Liechtenstein Exception — EAS Coverage of Security Tokens

Liechtenstein stands alone among the 18 in extending an investor-compensation scheme to blockchain-based financial instruments. The Deposit Guarantee and Investor Compensation Foundation PCC (EAS) — a protected cell company — covers security tokens (blockchain-based instruments issued via distributed ledger technology that correspond to the characteristics of traditional securities) up to CHF 30,000 per investor per institution.

This represents a narrow but important precedent. Coverage is limited to security tokens specifically (not utility tokens, payment tokens, or unbacked cryptoassets), institutional/financial-industry clients are excluded, and the CHF 30,000 cap is modest. However, the framework demonstrates that extending traditional investor protection to tokenized assets is technically and legally feasible under the Blockchain Act (TVTG, 2020). Liechtenstein's registered TT service providers must in parallel obtain MiCAR authorisation by 1 July 2026 under the EEA MiCAR Implementation Act.

Sources:

4.5 The Cross-Border Compliance Overlay

A jurisdiction-spanning gap sits underneath all of the above: insurers covering cross-border digital asset activity face persistent AML/CFT compliance uncertainty. In its sixth Targeted Update (26 June 2025), the FATF reported that of 138 jurisdictions assessed for Recommendation 15, only ~1% were fully compliant and 29% largely compliant — meaning roughly 70% are not yet largely or fully compliant with AML/CFT standards for virtual assets. This under-compliance compounds the coverage gap, because regulatory-action and sanctions losses (Section 1.3) are uninsurable precisely where compliance certainty is weakest. See International Standards.

5. What Works: Closing the Gap — Evidence-Based Approaches

5.1 South Korea — VAUPA Mandatory Insurance (Tested Under Stress)

South Korea's Virtual Asset User Protection Act (VAUPA), enacted in 2023 and effective 19 July 2024, requires VASPs to maintain liability insurance or equivalent reserves covering at least 5% of hot-wallet assets. This mandate was tested by the November 2025 Upbit hack (~KRW 44.5 billion / ~USD 28 million in Solana tokens), where over 1 billion coins were drained in 54 minutes.

Unlike pre-2025 incidents (covered by corporate funds, with no insurance record), the November 2025 Upbit losses were fully restored through VAUPA-mandated insurance and reserves — the first publicly reported use of the framework to cover a hack — and Upbit raised its cold storage ratio to 95%. The February 2026 Bithumb keystroke-error episode (~620,000 BTC nominal distributed to 249 users) saw ~99.7% recovered (industry-reported).

However, the incident exposed a critical gap: unlike traditional banks covered under the Electronic Financial Transactions Act (EFTA), crypto exchanges are not legally obligated to compensate users unless negligence can be proven. In response, the ruling Democratic Party advanced a second-phase DABA bill (8 April 2026) introducing bank-style no-fault compensation (fines up to 3% of annual revenue) — but this remains PROPOSED, not enacted as of 4 June 2026, having been dropped from the National Policy Committee subcommittee agenda on 12 May 2026 with review pushed into H2 2026. A separate April 2026 operational-resilience package (5-minute reconciliation, automatic kill switch, monthly audits, CRO/Risk Committee) does not change the Section-2 insurance/reserve thresholds.

Assessment: South Korea's approach demonstrates that mandatory insurance/reserve requirements can function under stress, but the ≥5% hot-wallet floor proved thin and the negligence-based liability standard creates uncertainty. The proposed (not yet enacted) shift to no-fault compensation represents an important — but still incomplete — evolution.

Sources:

5.2 Hong Kong — SFC Mandatory Compensation Arrangement

Hong Kong's compensation arrangement requirement (50% cold / 100% hot) is the most granular mandatory regime globally. Its strength lies in its flexibility — allowing third-party insurance, reserved virtual assets, earmarked deposits, or bank guarantees — which accommodates the limited insurance market capacity while ensuring some form of financial backing exists across 13 licensed VATPs (May 2026).

The weakness is the 50% cold storage cap, which was a pragmatic concession to insurance cost and availability constraints rather than a risk-based determination. As the market matures and domestic insurer capacity expands (subject to the Insurance Authority's capital-expensive 100% downward stress factor confirmed 8 May 2026), regulators should consider revisiting this threshold.

5.3 Lloyd's Capacity Expansion

Lloyd's of London remains the primary source of specialized digital asset insurance capacity globally, accessed by buyers across virtually every jurisdiction in the matrix (including those, like Canada, Australia, Bahrain and Liechtenstein, with no domestic underwriting supply). Key developments:

  • Lloyd's Product Innovation Facility (PIF): ~GBP 150 million in capacity, supporting non-standard risks including crypto (self-reported)
  • Syndicate participation: Arch, Atrium, Beazley, and Canopius all underwrite crypto risks through Lloyd's
  • Evertas: a dedicated crypto insurer operating as a Lloyd's coverholder (Arch lead capacity), offering up to $420 million per policy for custodial assets (self-reported, 2023)
  • AnchorWatch: a Lloyd's coverholder offering up to $500 million per customer for bitcoin (self-reported)
  • On-chain payment: Lloyd's-backed policies (Evertas/Nayms) can be paid on-chain via Ethereum/USDC, reducing friction for digital-native buyers

The constraint remains aggregate capacity: even with these developments, total Lloyd's market capacity for digital assets is estimated in the low single-digit billions — insufficient to absorb a major correlated loss event.

Sources:

5.4 Bermuda Captive Structures

Bermuda has positioned itself as the leading jurisdiction for digital asset captive insurance structures, with dedicated innovative classes (Class IIGB commercial / Class IILT long-term) under a single integrated regulator (BMA). Relm Insurance, the first/only Class IIGB commercial insurer, writes D&O, professional indemnity, crime, cyber, smart-contract-failure and staking/slashing cover.

Key developments:

  • Stablecoin integration (reported April 2026): Counsel-reported BMA policy permitting limited-purpose insurers/captives to use BMA-recognized stablecoins (fully collateralized, audited, 1:1 redeemable) for premium, claims and capital (partially verified — a policy position rather than a discrete rule)
  • Bitcoin-denominated life insurance: Meanwhile Insurance, a Bitcoin-only life insurer, holds a Class IILT licence and has released audited BTC-denominated financial statements
  • Embedded supervision pilot: the BMA completed an Embedded Supervision Solution for DeFi (with Chainlink/Apex/Bluprynt/Hacken) on 6 May 2026, testing direct integration of regulatory oversight into protocol technology
  • Proposed PSPI class: a Parametric Special Purpose Insurer class is under consultation (targeted end Q2 2026; traditional parametric only)

Bermuda's reinsurance market provides a deep infrastructure base for digital asset captive formation (ABIR 2024 GWP > USD 188 billion across all lines, self-reported).

Sources:

5.5 Industry-Funded Compensation Scheme Proposals

Several proposals for industry-funded compensation schemes have been advanced, modeled on the FSCS (UK), SIPC (US), or securities compensation funds:

  • Exchange-funded pooled reserve: Requiring all licensed exchanges to contribute a percentage of revenue to a pooled compensation fund, drawing on the South Korean VAUPA model
  • Token-based mutual insurance: Using smart contracts to create transparent, on-chain pooled reserves with parametric payout triggers
  • Tiered contribution based on risk profile: Higher contributions from exchanges with larger hot wallet ratios or fewer security certifications

The closest live analogue is the UAE's VARA ETD Insurance Fund (effective 31 March 2026) — a mandatory default-protection buffer that must never fall below a level sufficient to cover client negative-equity balances under "extreme but plausible" conditions — but it is scoped to exchange-traded derivatives, not a general compensation scheme. Otherwise, none of these proposals has been implemented at scale as a general retail-facing scheme in a major jurisdiction as of June 2026. The primary obstacles are moral hazard (reducing exchanges' incentive to invest in security) and the free-rider problem (well-managed platforms subsidizing poorly-managed ones).

Based on the evidence documented in this section and across the companion guidance documents, the following framework addresses the most critical coverage gaps.

6.1 Mandate Minimum Coverage — With Realistic Floors

Regulators should mandate minimum insurance or equivalent compensation arrangements for all licensed digital asset custodians and exchanges. Recommended thresholds:

  • Hot wallet exposure: 100% coverage required (following the Hong Kong SFC model; South Korea's ≥5% floor is demonstrably too thin)
  • Cold wallet exposure: Minimum 50% coverage initially, with a published schedule to increase to 80% over 3-5 years as market capacity develops
  • Acceptable forms: Third-party insurance, bank guarantees, reserved virtual assets, earmarked reserves in qualifying liquid assets, or a combination (the Hong Kong / South Korea "insure-or-reserve" and Cayman / Bermuda "insure-or-mitigate" flexibility accommodates thin underwriting supply)

6.2 Address the Nation-State Exclusion Gap

The exclusion of nation-state attacks from commercial insurance creates a systemic coverage void — and, given Lazarus Group's $2.02 billion 2025 haul, the single largest loss category. Regulatory options include:

  • Government backstop facility: Analogous to terrorism risk insurance (TRIA in the US, Pool Re in the UK), providing reinsurance capacity for state-attributed cyber losses above a threshold
  • Mandatory disclosure: Require insurers to clearly disclose the nation-state exclusion to policyholders and mandate that marketing materials not imply coverage for state-sponsored attacks
  • Attribution standards: Establish clear, jurisdiction-specific attribution standards to reduce disputes over when the exclusion applies

6.3 Standardize Valuation Methodology

Regulators should require policies to specify:

  • The price source (or hierarchy of sources) for determining loss valuation
  • The time reference point (moment of loss vs. detection vs. reporting)
  • Treatment of illiquid tokens and tokens that have lost all value
  • Currency of settlement and conversion timing

6.4 Require Cross-Chain Coverage Clarity

For platforms engaging in cross-chain operations, regulators should require:

  • Explicit policy language addressing bridge-related losses
  • Identification of which entity's policy responds in multi-chain scenarios
  • Disclosure of coverage gaps in cross-chain operations to users

6.5 Establish Deposit-Protection-Like Schemes for Retail

Given the universal exclusion of unbacked crypto from existing deposit guarantee schemes (13 of 13 schemes that address it exclude it; only Liechtenstein extends partial security-token coverage), regulators should consider:

  • Liechtenstein model extension: Expanding security token coverage to other tokenized asset categories
  • Standalone crypto compensation funds: Industry-funded, with mandatory participation as a licensing condition (the UAE ETD Insurance Fund is the nearest live precedent)
  • Risk-based contributions: Calibrated to each participant's custody model, security posture, and loss history

6.6 Promote Capacity Development

Regulatory actions that support insurance capacity growth include:

  • Permitting captive structures for digital asset risk (Bermuda model; Cayman SPC/captive infrastructure)
  • Allowing stablecoin-denominated insurance operations under appropriate prudential safeguards (Bermuda)
  • Providing regulatory clarity that reduces the uncertainty premium in insurance pricing
  • Calibrating insurer capital charges so that emerging domestic crypto underwriting is not priced out (mindful of EIOPA's pending 100% stress and Hong Kong's confirmed 100% downward stress factor)
  • Supporting the development of actuarial standards for digital asset risk (see Actuarial Risk Modeling)

Verification Notes

This is a refresh synthesis mirroring the canonical per-jurisdiction fact matrix (.claude/digital-asset-insurance-fact-matrix.json) covering all 18 jurisdictions; no new jurisdictions were added this cycle and no web searches were performed. All facts derive from the matrix or the prior verified version of this file. Market-capacity, premium and per-policy figures are flagged as self-reported with their source. Aggregates ("X of N") are computed for N=18.

Key statistics verification:

StatisticValueSourceVerification Status
Jurisdictions synthesised18Fact matrixMirrored from matrix
Deposit/investor schemes that address crypto and exclude unbacked crypto13 of 13Fact matrix (t3)Computed from matrix
Jurisdictions extending any scheme coverage to a tokenised instrument1 (Liechtenstein, security tokens, CHF 30,000)Fact matrix (t3)Computed from matrix
2025 total crypto theft~$3.4 billionChainalysis 2026 reportMirrored from matrix
Bybit hack amount~$1.5 billionCNBC, ChainalysisMirrored from matrix
North Korea 2025 theft$2.02 billionChainalysisMirrored from matrix
Crypto market cap~$3.31 trillionRisk & InsuranceMirrored from matrix
Insurance penetration~11% of holdersAM Best / GlobalData (self-reported)Mirrored from matrix
GWP estimate$150-300 millionCII / Howden London MarketMirrored from matrix
Marsh DART facility capacity$825 millionMarsh press release (March 2024, self-reported)Mirrored from matrix
Evertas per-policy limitup to $420 millionGlobeNewsWire (June 2023, self-reported)Mirrored from matrix
AnchorWatch per-customer limitup to $500 millionLloyd's coverholder (self-reported)Mirrored from matrix
Hong Kong SFC compensation arrangement50% cold / 100% hot; 13 VATPsMatrix (t1/t4); IA conclusions 8 May 2026Mirrored from matrix
US FDIC stablecoin reservesNOT pass-through insured (NPR FIL-11-2026, 7 Apr 2026, proposed)Matrix (t3/t7)Mirrored from matrix
SEC/CFTC joint interpretation17 March 2026 (Release 33-11412)Matrix (t7)Mirrored from matrix
Canada Stablecoin ActRoyal Assent 26 Mar 2026, not yet in forceMatrix (t7)Mirrored from matrix
Cayman first full VASP licenceBCXPro, 5 Feb 2026; MC-RSOG effective Feb 2026Matrix (t5/t7)Mirrored from matrix
Australia Digital Assets Framework ActRoyal Assent 8 Apr 2026, commences 9 Apr 2027Matrix (t1/t7)Mirrored from matrix
Japan FIEA billCabinet-approved 10 Apr 2026; penalty up to 10yr / JPY 10MMatrix (t4/t7)Mirrored from matrix
Singapore MPI/DPT licences37 (4 June 2026)Matrix (recent)Mirrored from matrix
South Korea no-fault liabilityPROPOSED, not enacted; DABA phase-2 bill 8 Apr 2026Matrix (t7)Mirrored from matrix
EU Solvency II Delegated Reg (EU) 2026/269OJ 18 Feb 2026; no crypto-specific chargeMatrix (t7/recent)Mirrored from matrix
EIOPA 100% crypto stressPending subsequent delegated act, not yet enactedMatrix (t7)Mirrored from matrix
MiCA transition end1 July 2026Matrix (t7)Mirrored from matrix
Liechtenstein EASPCC; security tokens up to CHF 30,000Matrix (t3)Mirrored from matrix
Bahrain insurance mandatePII (BHD 100,000), keyman, cybersecurityMatrix (t4)Mirrored from matrix
UAE VARA ETD Insurance FundEffective 31 March 2026Matrix (t3/recent)Mirrored from matrix
FATF R.15 compliance (June 2025)~1% fully / 29% largely compliant of 138 assessedFATF 2025 Targeted UpdateMirrored from international-standards

Data gaps and limitations:

  • GWP figures for digital asset insurance lines are estimates; no comprehensive industry reporting exists comparable to cyber insurance GWP tracking.
  • Total insurance market capacity and all per-policy/facility limits are self-reported by providers and do not capture private placements or bespoke arrangements.
  • The ~1% insurance penetration rate (as percentage of market cap) and ~11% holder-penetration figure are self-reported approximations and should be treated as indicative.
  • DeFi/parametric insurance classification (t6) is "NOT VERIFIED / NO DATA" in the matrix for Australia, Hong Kong, Japan and South Korea, and "not discussed" for Bahrain and the Emerging Markets cluster — those silences are reflected honestly rather than filled.
  • Q1 2026 theft data (~$169 million, down sharply YoY) is a preliminary self-reported aggregator figure.
Graph view