Insurance Product Taxonomy

1. Product Classification Matrix

Digital asset insurance has evolved from a handful of bespoke Lloyd's placements into a distinct product ecosystem spanning at least eleven recognisable coverage categories. No single policy covers all digital asset risks; institutional buyers typically assemble a programme from multiple products below. The products are demand-shaped by the regulatory posture of each market: across the 18 jurisdictions surveyed in this domain, four require insurance outright (

Hong Kong,

South Korea,

Bahrain,

UAE), two make it mandatory-in-substance through custody-tier gating or an "insure-or-mitigate" conduct rule (

Canada,

Cayman Islands), and the remainder treat it as a voluntary or alternative-to-own-funds safeguard. Detailed mandate analysis sits in Custodian Insurance Requirements by Jurisdiction.

1.1 Crime / Specie Policies

Crime and specie coverage is the oldest and most frequently purchased form of digital asset insurance.

Lloyd's of London specie syndicates adapted traditional vault-and-bullion wordings to cover cryptographic key material and the assets those keys control.

Coverage scope:

• Internal theft -- employee collusion, rogue traders, insider key compromise
• External hack -- unauthorised access to hot wallets, exchange infrastructure, or custodian systems
• Social engineering -- phishing, SIM-swap, and business email compromise leading to key exfiltration (often sublimited or subject to enhanced deductibles)
• Physical theft -- theft or destruction of cold-storage media (hardware wallets, seed-phrase backups, HSMs) on-premises or in transit

Hot wallet vs. cold wallet distinction: Virtually every crime/specie policy draws a sharp line between assets held in internet-connected (hot) wallets and offline (cold) storage. Hot wallet coverage commands substantially higher premium rates (typically 2--5x the cold wallet rate) and lower sublimits because the attack surface is larger. Policies may cap hot wallet exposure at 2--10% of the total insured amount, mirroring the cold/hot storage ratios that regulators mandate:

Hong Kong's SFC requires at least 98% cold storage and a compensation arrangement covering 100% of hot-wallet and 50% of cold-storage client assets;

Singapore's MAS PS-G03 caps hot storage at 10% (at least 90% cold); and

South Korea's VAUPA pairs an 80% cold-storage minimum with mandatory insurance or reserves covering at least 5% of hot-wallet assets.

Munich Re's Digital Asset Comprehensive Crime (Plus) policy is the most widely cited carrier-branded product, covering custody liability against employee fraud, external hacking, physical theft of cold-storage media, and breaches of external wallet technology service providers. In

Germany, Munich Re is the domestic underwriting champion, pairing this product with Boerse Stuttgart Digital's fully-insured institutional custody and staking offering.

1.2 Custody Insurance

Custody insurance extends crime/specie concepts to the full custodial chain:

• Institutional custody -- policies written for qualified custodians (banks, trust companies, regulated exchanges) covering assets under management. Limits range from below USD 50 million for smaller exchanges to hundreds of millions for large institutions. Marsh's Digital Asset Risk Transfer (DART) global facility provides capacity up to USD 825 million for digital asset custodians (self-reported), and
  Hong Kong-based exchange OSL secured a USD 1 billion custody programme led by Canopius (Lloyd's) in October 2024 (self-reported).
• Retail custody -- Coincover's Lloyd's-backed wallet protection scheme covers individual hot wallets with dynamic limits that adjust in line with crypto price fluctuations. Underwritten by Atrium (lead) with participation from TMK and Markel.
• Self-custody -- AnchorWatch offers Lloyd's-backed coverage for self-custodied Bitcoin held in collaborative 2-of-3 multisig vaults, with policies starting at 0.55% of holdings annually; its Lloyd's binding authority began at USD 100 million per customer (November 2024) and has since been reported as raised to USD 500 million per customer (self-reported).

Coverage triggers typically include theft, hack, key compromise, and physical loss of storage media. Sub-custodian failure is an emerging area; policies may or may not cover losses arising from a custodian's sub-custodian (the "custody chain gap" discussed in Coverage Gaps & Exclusions).

1.3 Cyber Insurance

Traditional cyber policies (network security liability, privacy liability, business interruption, incident response costs) overlap with but do not replace crypto-specific coverage. Key gaps and overlaps:

• Overlap: Ransomware response, forensic investigation, regulatory notification costs
• Gap: Most standard cyber forms exclude first-party loss of digital assets (treated as "money" or "securities" excluded from cyber, or subject to a digital asset exclusion). The asset itself falls outside the cyber tower; the operational disruption and third-party liability may be covered.
• Hybrid products: WTW and Munich Re have developed hybrid policies blending cyber and digital asset risks, and the market is moving toward parametric cyber covers triggered by on-chain events.
• Regulatory tailwind: Cyber cover is increasingly a hard requirement, not just a discretionary purchase.
  Bahrain's CBB has mandated cybersecurity insurance for crypto-asset licensees since March 2023, and the
  UAE's DFSA requires both professional indemnity and cyber insurance for crypto-token firms (effective 12 January 2026).
  Cayman's February 2026 Market Conduct RSOG lists cybersecurity among the insurance categories VASPs must hold on an insure-or-mitigate basis -- a direct response to a CIMA review finding that 82% of reviewed VASPs carried no cybersecurity insurance.

Crypto firms should expect to purchase both a cyber policy (for operational and third-party liability) and a separate crime/specie policy (for first-party asset loss).

1.4 Directors & Officers (D&O) Insurance

D&O coverage for crypto firms is available but materially more expensive than for comparable traditional financial services companies.

• Pricing: Crypto/DeFi firms typically pay 2--3x the premiums of mainstream peers, with package policies at USD 1 million limits ranging from USD 35,000 to USD 100,000+ for standard technology firms, and substantially more for crypto-native businesses.
• Availability: Improving as of 2025--2026, driven by a wave of crypto firms preparing for public listings and by clearer regulatory frameworks. In the
  US, the SEC and CFTC issued a binding joint crypto-asset interpretation (SEC Release 33-11412 / CFTC PR 9198-26, 17 March 2026) establishing a five-part token taxonomy, and the SEC enforcement retreat through 2025 has improved D&O availability; in the
  EU, MiCA is fully effective with its transitional period ending 1 July 2026.
• Common exclusions: Prior acts, pending litigation at inception, regulatory investigations commenced before policy inception, fraud/dishonesty of the insured directors, and cryptocurrency-specific exclusions such as losses arising from protocol participation or token issuance activities.
• Key insurers: Beazley, AIG, Chubb, Arch, and several Lloyd's syndicates now write D&O for crypto firms; in
  Bermuda, Relm (the first/only Class IIGB commercial insurer) writes D&O alongside professional indemnity, crime, cyber, smart contract failure, and staking/slashing cover. Woodruff Sawyer and Founder Shield act as specialist brokers.

1.5 Errors & Omissions (E&O) / Professional Liability

E&O coverage protects digital asset service providers -- custodians, exchanges, wallet providers, staking operators, auditors, and smart contract developers -- against claims arising from professional negligence, software bugs, or failure to perform services as contracted.

• Coverage typically extends to: failure in custody operations, incorrect transaction execution, software defects in wallet or exchange infrastructure, and negligent security assessments.
• Smart contract audit firms increasingly require E&O coverage as a condition of engagement.
• Professional indemnity (PI) is the most commonly mandated form of digital asset insurance worldwide.
  Australia's AFSL regime already requires adequate PI insurance, and the Digital Assets Framework Act 2026 (Royal Assent 8 April 2026, commencing 9 April 2027) brings Digital Asset Platforms and Tokenised Custody Platforms under that AFSL PI obligation without prescribing a crypto coverage ratio. The
  UAE (VARA, ADGM FSRA, and DFSA) and
  Bahrain (CBB minimum BHD 100,000, ~USD 265,000) likewise mandate PI for licensed providers.

1.6 Commercial Crime / Fidelity Bonds

Traditional commercial crime (fidelity) bonds adapted for digital assets cover:

• Employee dishonesty (theft of digital assets by insured employees)
• Forgery or alteration (manipulation of transaction records)
• Computer fraud (unauthorised transfer of digital assets)
• Funds transfer fraud (social engineering leading to misdirected transfers)

These policies differ from specie coverage in that they focus on the act of the employee or third party rather than the nature of the asset. They are often stacked with specie policies to create comprehensive first-party protection. Crypto.com's Custody Trust Company holds USD 120 million in crime and specie insurance, with USD 100 million for cold-stored digital assets, arranged by Aon through Lloyd's underwriters (self-reported). Fidelity bonds are also a regulatory gating mechanism:

Canada's CIRO Digital Asset Custody Framework (February 2026) requires a fidelity/financial-institution bond across all storage tiers (and specie cover for cold storage) as a gating factor for custodian tier approval, while Nigeria's SEC mandates a fidelity bond of at least 25% of a VASP's minimum paid-up capital.

1.7 Staking / Validator Insurance

Proof-of-Stake consensus mechanisms introduce slashing risk -- the permanent loss of staked assets as a penalty for validator misbehaviour or extended downtime. Insurance products in this category include:

• Slashing coverage: Blockdaemon offers 100% slashing protection for institutional staking clients, covering rewards missed due to downtime and slashing penalties.
• Liquid staking partnerships: Lido partnered with Unslashed Finance to cover approximately USD 200 million of staked ETH against slashing events.
• Exchange-level guarantees: Bitget maintains a Protection Fund exceeding USD 300 million that covers staking participants against validator slashing.
• Carrier products: Munich Re offers dedicated Staking Risk & Errors & Omissions Insurance protecting against losses from PoS consensus mechanism violations; in
  Bermuda, Relm writes staking/slashing cover as part of its full-stack digital asset programme.

Ethereum slashing penalties can reach 5% or more of a validator's bonded stake for safety violations, with correlated slashing events (multiple validators slashed simultaneously) carrying escalating penalties.

1.8 Smart Contract Failure Insurance

Smart contract coverage protects against financial loss caused by bugs, exploits, or unintended behaviour in deployed smart contract code. This is offered through both traditional and DeFi insurance channels:

• Traditional: Munich Re's Smart Contract Risks Insurance covers asset loss from failures, breaches, compromises, or exploitations by external parties. Policies typically require independent code audits and security reviews as preconditions. This is one of the few smart-contract failure products that is a regulated commercial insurance contract rather than a discretionary arrangement.
• DeFi protocols: Nexus Mutual (capital pool ~USD 190 million; ~USD 194 million in active cover; ~USD 18 million in claims paid since 2019, self-reported) offers smart contract cover priced below 1% annually for select audited projects. InsurAce operates across multiple blockchain networks (NOT VERIFIED count this cycle). Unslashed Finance uses a "buckets" model combining multiple policies for capital efficiency. These protocols are discretionary risk-sharing arrangements, not licensed insurers, in every jurisdiction surveyed (see Section 1.12).
• Parametric: Emerging parametric products trigger automatic payouts based on on-chain events (e.g., total value locked dropping below a threshold), verified via oracles, eliminating traditional claims adjudication delays (see Parametric & On-Chain Insurance).

1.9 NFT / Digital Collectibles Coverage

NFT insurance remains nascent and significantly more expensive than traditional fine art coverage:

• Premium rates: 2--5% of insured value, compared to 0.1--2% for traditional fine art policies
• Coverage approach: NFTs may be insured under adapted fine art/specie wordings or under dedicated digital asset crime policies. Hunton Andrews Kurth has documented coverage under existing crime, specie, professional liability, E&O, and D&O policies. Canopius's Lloyd's Asia digital asset custody policy (
  Singapore, from May 2023) expressly extends to crypto, stablecoins, and tokens including NFTs.
• Valuation challenges: Rapid price fluctuation, difficulty establishing provenance (anonymous creators), and the distinction between the token and the underlying digital content complicate underwriting.
• Market status: Major art insurers have not yet uniformly extended fine art policy coverage to NFTs, though bespoke placements are available through Lloyd's and specialty markets.

1.10 Mining Equipment Insurance

Crypto mining insurance covers the physical infrastructure and business continuity risks of mining operations:

• Property coverage: Mining rigs (classified as Electronic Data Processing / EDP equipment), containers, cooling systems, fire suppression, transformers, and power supply systems. Evertas offers mining hardware limits up to USD 200 million (self-reported).
• Business interruption: Lost income and operating expenses when mining operations are interrupted by covered perils (fire, natural disaster, equipment failure, power grid disruption).
• Valuation methods: Replacement Cost Value (RCV) -- replaces damaged equipment with new equivalent; Actual Cash Value (ACV) -- accounts for depreciation. RCV is preferred for operational continuity but commands higher premiums.
• Market challenge: Many traditional property insurers consider crypto mining high-risk due to concentrated electrical load, fire risk, and remote locations. Specialist underwriters (Evertas, Fullsteam) dominate this segment.

1.11 Stablecoin & DeFi Protocol Coverage

An emerging product category covering risks specific to stablecoins and DeFi protocols:

• De-pegging risk: Parametric products paying out when a stablecoin's market price deviates beyond a defined threshold from its peg
• Oracle manipulation: Coverage for losses arising from corrupted or manipulated price feeds
• Governance attacks: Protection against hostile governance proposals that drain protocol treasuries
• Liquidity pool exploits: Coverage for impermanent loss amplified by exploits or economic attacks
• Bridge exploits: LI.FI and InsurAce offer bridge insurance at 0.1--0.5% of the bridged amount, providing 100% protection against cross-chain transfer failures

This category is shaped by an unsettled prudential treatment of stablecoin reserves. In the

US, the FDIC's April 2026 GENIUS Act NPR (FIL-11-2026) confirms that stablecoin reserves are not pass-through deposit-insured, leaving private insurance and reserve adequacy as the only protective layers;

Hong Kong's Insurance Authority will apply a look-through plus counterparty-default overlay to stablecoin exposures under its forthcoming RBC framework (consultation conclusions 8 May 2026).

1.12 DeFi Protocol Cover vs. Regulated Insurance (Classification)

A recurring theme across the surveyed markets is that DeFi "insurance" protocols are discretionary risk-sharing arrangements, not regulated insurance, in every jurisdiction that has addressed them:

• In the
  UK, Nexus Mutual is a discretionary mutual (members have no contractual obligation to pay claims); it is not "insurance business" under FSMA and operates without FCA authorisation as an insurer.
• In
  Singapore, MAS has not classified Nexus Mutual, InsurAce, or Unslashed Finance as Insurance Act products; genuinely decentralised protocols fall outside the MAS perimeter with no statutory consumer protection.
• In the
  US, DeFi protocols are an unlicensed regulatory grey area; NXM tokens may be securities under Howey, but no enforcement action had been taken as of the SEC/CFTC March 2026 interpretation.
• In the
  EU, MiCA does not apply to "fully decentralised" services, but the term is undefined; discretionary mutuals likely fall outside Solvency II, MiFID II, and gambling regimes, with no definitive ruling.

By contrast,

Bermuda is building a regulated pathway (innovative Class IIGB/IILT, sandbox, and a proposed Parametric Special Purpose Insurer class), and Munich Re's Smart Contract Risk Insurance (

Germany) is a regulated commercial product. The distinction between regulated insurance and discretionary mutual is developed further in DeFi Insurance Protocols.

2. Key Underwriters by Product Type

2.1 Lloyd's Syndicates

Lloyd's of London is the dominant market for digital asset insurance, providing the majority of global capacity through specialised syndicates:

2.2 Specialty MGAs and Coverholders

2.3 Traditional Carriers

2.4 Brokers and Facilities

3. Policy Structure

3.1 Coverage Triggers

Digital asset policies are triggered by defined events, not by general "all risks" language. Common triggers include:

• Theft by external party -- unauthorised access resulting in transfer of digital assets out of insured wallets
• Theft by internal party -- employee dishonesty, collusion, or unauthorised use of key material
• Key compromise -- loss, theft, or destruction of private keys or seed phrases (Canopius wordings extend to "mysterious disappearance" of private keys)
• Physical damage/destruction -- fire, flood, or other perils damaging cold storage media
• Protocol failure -- consensus bugs, chain reorganisations (rare; usually excluded or heavily sublimited)
• Smart contract exploit -- unintended code execution resulting in asset loss (specialist policies only)
• Social engineering -- phishing, SIM-swap, or impersonation leading to key disclosure (often sublimited)

3.2 Valuation Methodology

Asset valuation is among the most contentious aspects of digital asset claims. Three primary methodologies exist:

Some policies use a "lesser of" formula (lesser of time-of-loss or time-of-claim value), and Coincover's dynamic limit approach adjusts coverage limits automatically with price changes. Valuation disputes are a major source of coverage litigation (see Coverage Gaps & Exclusions).

3.3 Sublimits and Aggregation

• Hot wallet sublimit: Typically 2--10% of total policy limit
• Social engineering sublimit: Often 10--25% of the crime/specie limit
• Single-occurrence aggregation: Multiple thefts arising from the same vulnerability or attack campaign are typically aggregated as a single occurrence
• Annual aggregate: Many policies carry an annual aggregate limit equal to the per-occurrence limit, meaning one large loss can exhaust the policy
• Sub-custodian exposure: May be sublimited or excluded entirely

3.4 Deductibles and Retentions

• Percentage deductibles: Common for volatile assets; 1--5% of the loss amount
• Fixed deductibles: USD 50,000--500,000 for institutional crime/specie policies
• Waiting periods: For business interruption, typically 12--24 hours
• Self-insured retentions (SIRs): Larger institutions negotiate SIRs instead of deductibles, often USD 1--5 million

3.5 Standard Market Exclusions

The following exclusions appear across virtually all digital asset insurance policies (detailed analysis in Coverage Gaps & Exclusions):

• Market value depreciation (price volatility)
• Regulatory action, sanctions, or government seizure
• Fraudulent or dishonest acts by the policyholder
• War, terrorism, and nation-state attacks (cyber war exclusion)
• Nuclear, biological, chemical events
• Unsecured or negligent key management (failure to follow mandated security protocols)
• Unrecognised or unsupported cryptocurrencies
• Blockchain-wide failures or consensus-level bugs
• Voluntary transactions (including rug pulls absent fraud by a covered party)

4. Pricing & Capacity

4.1 Premium Rates

Premium rates vary significantly by coverage type, security posture, and asset class:

4.2 Global Capacity

All figures below are self-reported by the named broker/carrier and are not independently audited:

• Total estimated global capacity: USD 1--2 billion (UNVERIFIED aggregate estimate across all markets)
• Marsh DART facility: USD 825 million (single largest named facility)
• OSL custody programme (Hong Kong): USD 1 billion (Canopius-led, Oct 2024)
• Aon cold storage facility: USD 625 million (led by Canopius)
• Aon individual client capacity: Exceeding USD 1.2 billion
• Evertas per-policy limit: USD 420 million (custody, with Arch); USD 200 million (mining)
• Canopius Lloyd's Asia line: Up to USD 130 million per line (Singapore)
• AnchorWatch binding authority: Up to USD 100 million per customer at launch, later reported up to USD 500 million

4.3 The Protection Gap

The gap between insurable digital asset value and available coverage remains enormous:

• Total crypto market capitalisation: ~USD 3.3 trillion (early 2025 reference point)
• Insurance penetration: Only ~11% of global crypto holders have any insurance coverage (AM Best, self-reported)
• Unmet demand: A large majority of uninsured holders express readiness to purchase or willingness to consider coverage
• Annual theft/hack losses: ~USD 2.2 billion (2024, TRM Labs); ~USD 3.41 billion (2025, Chainalysis); ~USD 168.6 million in Q1 2026, down ~88% YoY (preliminary aggregator estimate)
• Gross written premium (digital asset lines): Estimated USD 150--300 million (2024, Howden)
• Market growth: The crypto insurance line is widely projected to grow at a strong double-digit CAGR over the coming decade, but published forecasts vary by source and are self-reported.

5. Comparative Product Table

Verification Notes

This taxonomy is a refresh synthesis (modified 2026-06-04). Product-by-jurisdiction facts mirror the canonical per-jurisdiction fact matrix maintained for this domain (.claude/digital-asset-insurance-fact-matrix.json, tiers t2/t6), which is itself sourced from web-accessible public sources. No new jurisdictions were added this cycle; all 18 surveyed markets are reflected.

• Self-reported figures: All market-capacity, per-policy-limit, premium, and coverage figures (Marsh DART USD 825M, OSL USD 1B, Aon USD 625M / USD 1.2B+, Evertas USD 420M custody / USD 200M mining, Canopius USD 130M/line, AnchorWatch USD 100M→USD 500M, Crypto.com USD 120M, ~11% penetration) are self-reported by the named broker/carrier or an industry aggregator and are not independently audited.
• DeFi protocol figures: Nexus Mutual capital pool ~USD 190M, active cover ~USD 194M, and claims paid ~USD 18M since 2019 are taken from the protocol's own reporting and are flagged self-reported. (The widely circulated "USD 4.4B protected" figure is a self-reported cumulative metric and is not used as a headline here.)
• Regulatory facts reflect the matrix as of 2026-06-04: US FDIC GENIUS-Act NPR (FIL-11-2026, Apr 2026) -- stablecoin reserves NOT pass-through insured; SEC/CFTC joint interpretation 17 Mar 2026; Canada CIRO fidelity/specie gating (Feb 2026); Cayman MC-RSOG insure-or-mitigate (Feb 2026, 82% uninsured finding); Australia AFSL PI obligation under the Digital Assets Framework Act 2026 (Royal Assent 8 Apr 2026, commences 9 Apr 2027); Hong Kong 50%/100% compensation + IA 100% downward stress (conclusions 8 May 2026); South Korea VAUPA 5% hot / 80% cold; Singapore PS-G03 90% cold; Bahrain CBB PII (BHD 100,000) + keyman + cyber; UAE VARA four-category + DFSA PII+cyber; EU/Germany/France/Liechtenstein MiCA Art. 67 insurance-as-alternative with transition ending 1 Jul 2026.
• NOT VERIFIED / UNVERIFIED markers are preserved where the matrix does not substantiate a precise figure (Qubit/BDIC per-policy limits; Zurich participation in several markets; InsurAce network count this cycle).
• Cross-references use canonical deep-research/digital-asset-insurance/... wikilink paths because jurisdiction and guidance basenames are ambiguous across deep-research domains.