The crypto insurance market is bracing for a wave of stringent security reviews, tighter policy wordings, and potential new exclusions following a massive $6.3 billion cyber heist from global exchange Binance. Industry insiders and experts told Reuters that underwriters are urgently investigating whether current crypto clients harbor vulnerabilities similar to those exploited in the suspected North Korean operation last week. While overall insurance capacity, pricing, and coverage limits are unlikely to shift immediately, the hurdle to secure or renew annual policies is expected to rise significantly.
Key takeaways
- A suspected North Korean operation made off with $6.3 billion from Binance last week.
- Insurance policies covering losses as huge as Binance's reportedly do not exist.
- Global marketplace Lloyd's has generally required cyber policies to have state-backed attack exclusions since 2023.
- The NAIC reported that average claim sizes for businesses with at least $1 billion in revenue hit $4.4 million in 2025.
How underwriters are responding to growing risks
Jacqueline Quintal, financial institutions and digital asset industry leader at insurance broker Marsh, noted that underwriters are acutely aware of the systemic dangers involved in writing policies for digital asset institutions. According to Bloomberg reports, Binance insured some executives against personal liability but lacked dedicated cyber insurance unlike other major crypto companies. Alan Lyons, co-chair of the insurance group at law firm Herrick, explained that a loss of this magnitude prompts underwriters to re-examine their entire crypto portfolio rather than just individual clients. This involves reassessing aggregate exposure, specific policy wordings, and sub-limits across the board.
Market observers emphasize that insurance policies covering multi-billion-dollar losses like the Binance incident simply do not exist. Consequently, the broader crypto industry, valued at over $2.5 trillion, faces intense scrutiny during policy renewals. Insurers are expected to demand that digital asset firms patch any vulnerabilities tied to the Binance fiasco and tighten their overall security posture. Furthermore, policies may soon carry explicit new exclusions detailing scenarios where an insurer will legally refuse to pay out.
State-backed attacks and broader cyber insurance trends
The question of whether insurers will pay out in a Binance-style incident remains complicated, particularly regarding attribution. Marcos Alvarez, managing director of global financial institution ratings at Morningstar DBRS, pointed out that global marketplace Lloyd's has generally required cyber policies to feature exclusions for state-backed attacks since 2023. If a major exploit is formally attributed to a state, insurers may dispute or deny claims entirely, though the legal effectiveness of these geopolitical exclusions remains untested.
At the same time, the wider cyber insurance landscape is grappling with shifting threat dynamics. Data from the National Association of Insurance Commissioners indicates that while the overall frequency of claims for large businesses is decreasing, payouts are ballooning. The average claim size for businesses bringing in at least $1 billion in annual revenue reached $4.4 million in 2025, marking a 586 percent increase since 2021. Experts warn that supply chain vulnerabilities and the rapid deployment of AI systems introduce systemic, correlated risks that could further strain underwriting models if malicious actors scale their operations.
Comments