Crypto Insurance for Institutions: Coverage and Exclusions

By the Guardian team Updated November 2026 6 min read

Quick answer. Crypto insurance is a stack: crime for hot wallets and fraud, specie for cold storage keys, D&O and professional liability, and smart contract cover such as Nexus Mutual's. Market losses are generally excluded; limits rarely match assets held.

Watch: Crypto Insurance for Institutions: Coverage and Exclusions 1:40

Video transcript

If your institution's crypto is stolen, FDIC deposit insurance does not cover it. Protection comes from a stack of private policies, each with gaps.

Crime cover responds to theft and fraud, including from hot wallets. Specie covers cold storage keys, but not hacking, Aon notes. Liability, cyber and smart contract cover complete the stack.

MiCA lets providers meet prudential requirements with insurance, own funds, or both. Dubai's VARA requires professional indemnity, directors and officers, and crime cover for hot wallets.

Read the exclusions before the limit. Policies generally exclude market swings, Ponzi schemes, hardware loss and blockchain failures. Nexus Mutual's Protocol Cover also excludes phishing and private key breaches.

Aon's 2021 paper put available capacity at about 700 million US dollars, while most custodians stored tens of billions, so capacity is the binding constraint.

Underwriters judge the controls around the keys. Aon calls collusion the most pressing exposure for cold storage, so expect questions on how many people it takes to create a fraudulent transaction.

Map each wallet location to a policy. Ask custodians for their insurer and limit, and whether it is shared. Check that hacking and insiders are named, diary the renewal, and bring evidence.

Guardian is not an insurer or a broker. We help you show risk committees and regulators how your keys are controlled. Read the full guide, or talk to Guardian.

Before an institution holds crypto, its risk committee asks what happens if the assets are stolen. Insurance is part of the answer.

The usual US backstops mostly do not apply. The FDIC says deposit insurance does not cover crypto assets or a crypto company's failure. SIPC does not protect crypto that is not a security.

So protection comes from private policies, each with gaps. We mapped them from insurers', brokers' and regulators' own documents.

Policy Types

Policy	What it covers	Watch for
Commercial crime	Theft and internal or external fraud, including electronic theft	The usual home for hot wallets
Specie	Theft or destruction of keys in secured locations	Aon: it "does not cover hacking"
Professional indemnity (E&O)	Claims over errors in professional or technology services	Required by VARA
Directors and officers (D&O)	Management liability of the board and officers	Required by VARA
Cyber	"Highly customized", per the NAIC	Whether digital assets are covered at all
Smart contract cover	Protocol bugs, oracle failures, governance takeovers	Discretionary; long exclusion list

Lockton also lists slashing and staking, kidnap and ransom, and surety bonds.

Who writes it

Brokers: Aon, Marsh and Lockton arrange digital asset cover. Aon dates its record to the first "crypto crime" policies in 2013.
Lloyd's: Aon's 2021 paper describes its cold storage facility led by Canopius, which it calls a Lloyd's market leader.
Specialists: Relm is regulated in Bermuda, not licensed elsewhere, and deals only through licensed brokers.
Guarantees: Coincover sells key recovery and an insured guarantee on protected transactions. It says it "does not provide insurance coverage" itself.
Mutuals: Nexus Mutual is a discretionary mutual. Members pass KYC and pay 0.0020 ETH to join.

What Regulators Require

EU: MiCA Article 67

MiCA lets a crypto-asset service provider meet its prudential requirement with own funds, an insurance policy or comparable guarantee, or a mix. A policy used this way must:

Cover the EU territories where the services are provided.
Run at least one year, with 90 days' notice to cancel.
Come from an authorized third-party insurer.
Be disclosed on the provider's website.

It must cover loss of documents, misrepresentation, breaches of legal duties, conflict-of-interest failures, and losses from business disruption or system failures.

It must also cover liability to clients under Article 75(8) and, where relevant, gross negligence in safeguarding client assets.

Article 75(8) makes a custodian liable for crypto-assets lost through incidents attributable to it, capped at their market value when lost.

Dubai: VARA Rule VI.D

VARA's Company Rulebook requires insurance "adequate to the size and complexity of the business":

Professional indemnity.
Directors' and officers' insurance.
Commercial crime or similar cover for all virtual assets in hot wallets.
Anything else VARA judges appropriate.

Cover must sit with a regulated insurer. Where it is unobtainable for proven reasons, VARA may set other measures.

Common Exclusions

Read the exclusions before the limit. The NAIC says available policies "are far from comprehensive". They generally exclude:

Market fluctuations.
Ponzi-related schemes.
Direct hardware loss.
Losses from blockchain failures.

Specie alone can leave cold storage partly uncovered, Aon warns, because it does not cover hacking.

Smart contract cover has its own list. Nexus Mutual's Protocol Cover excludes, among others:

Phishing, private key breaches and malware, where the protocol works as intended.
User interface or website errors.
Failures of bridge components.
A depeg of an asset the protocol issues.
Rug pulls, and losses caused by the team's admin actions, such as pauses.
Bugs publicly disclosed before the cover started.

By default it deducts 5% of the cover amount, and no claim can be filed until 14 days after the event.

Two limits apply more broadly. Aon notes policies are written in fiat, so limits can lag when crypto prices rally.

And Coinbase warns that a loss "could result in a subsequent lapse in insurance coverage".

Capacity and Limits

Capacity is the binding constraint. Aon's 2021 paper put available capacity at about USD 700 million, while most custodians stored tens of billions.

Cold storage cover is written on an aggregated basis. Once one client erodes the limit, Aon says, "it is gone".

Published limits:

Aon and Canopius (2021 paper): up to USD 625 million.
Marsh Blue Vault (undated page): cold storage limits of up to US$150 million.
Aon's current practice page: "more than $1.2B in individual client capacity available".

Disclosures show the gap. Coinbase says customer assets are "substantially more than our corporate assets and available insurance".

Premiums

We found no insurer or broker that publishes crypto premium rates. Aon says hot wallet coverage costs more.

Specie, by contrast, offers larger limits for cold storage "at a much more competitive rate", per Aon.

How Underwriters Assess Security

Underwriters judge the controls around the keys. Aon calls collusion "the most pressing exposure" for cold storage.

The reason is scale. A group of insiders could move a firm's assets in one go.

Aon's materials point to questions like these:

What is the minimum number of people needed to create a fraudulent transaction?
How could it happen, and what systems prevent it?
How are client assets segregated?
What are your online and physical security protocols?
How experienced is the management team?
How strong are your AML and KYC procedures?

Aon calls a detailed roadmap of operational procedures "a major element of the contract".

Scrutiny does not stop at binding. Coinbase's cover depends on carriers' "ongoing underwriting criteria", and after a claim, investigators may inspect assets under custody and supporting systems.

How to Fill the Gaps

Map each location to a policy: hot wallets to crime, cold storage to specie, DeFi positions to protocol cover.
Ask custodians for the policy: insurer, limit, and whether the limit is shared across clients.
Check the triggers: hacking, insiders and social engineering, by name.
Diary the renewal: Coinbase's crime policy runs one year, without automatic renewal.
Cover exchange exposure: Nexus Mutual's Custody Cover starts at $1 million per custodian.
Shrink the exposure: keep more in cold storage, and raise the number of people needed to move funds.
Bring evidence: quorum design, key ceremony records, pentest reports and a CCSS assessment.
Under MiCA: decide with counsel whether insurance or own funds meets Article 67.

Custody Cover can pay after a crime that costs all users 10% or more, or an unannounced full withdrawal halt of 100 days or more.

More questions: our prime broker due diligence guide and vendor questionnaire.

How Guardian Helps

Guardian is not an insurer or a broker. We help you show counterparties, risk committees and regulators how your controls work.

For institutions, Guardian advises on custody, signing and control design, and turns it into committee-ready evidence.

Our regulatory assessments score key management against CCSS from evidence, not interviews. We also audit contracts and pentest offchain systems.

With Managed Security, our security operations team reviews every multisig transaction before it is signed. For key controls, see private key management.

Frequently Asked Questions

What does crypto insurance cover?

Crime cover responds to theft and fraud, including from hot wallets. Specie covers keys in cold storage. D&O and professional indemnity cover liability claims. Smart contract cover may pay for protocol bugs and oracle failures. Market losses are generally excluded.

Does FDIC insurance cover crypto?

No. The FDIC says deposit insurance does not cover crypto assets or protect against a crypto company's failure. SIPC does not protect crypto that is not a security, or unregistered investment contracts, even at a member firm.

Which companies provide crypto insurance?

Brokers including Aon, Marsh and Lockton arrange digital asset cover. Aon's 2021 paper describes a Lloyd's cold storage facility led by Canopius. Relm writes from Bermuda. Nexus Mutual offers discretionary cover to members.

Does smart contract cover pay if my keys are phished?

Not under Nexus Mutual's Protocol Cover. Its terms exclude phishing, private key breaches and malware where the protocol works as intended, and user interface errors. Key theft from your own systems belongs under crime cover.

Sources

Prove how your keys are controlled

Guardian reviews your custody, signing and control design, and turns it into evidence a risk committee, board or regulator can read.

Talk to Guardian Explore Guardian for institutions