Insurers After $6.3 Billion Crypto Heist: D’oh!

“Industry insiders and experts” told Reuters that underwriters are expected to investigate whether crypto clients are vulnerable to cyber heists such as the suspected North Korean operation that made off with $6.3 billion from global exchange Binance last week. Jacqueline Quintal, financial institutions and digital ​asset industry leader at insurance broker Marsh, told the agency she wouldn’t want to be the individual who renews or writes a policy for a crypto institution just to see another massive theft. Insurance capacity, pricing, and coverage are unlikely to change, she added, but questions about security will. It’s easy to see how that could result in higher barriers for policies or more claim rejections. Experts told Reuters insurance policies that cover losses as huge as Binance’s already don’t exist, and that the crypto industry, valued at over $2.5 trillion, will face tougher scrutiny when renewing policies (usually on an annual basis). Bloomberg had previously reported Binance insures some executives against personal liability, but “unlike other crypto companies” lacked cyber insurance. “A loss of this magnitude prompts underwriters to re-examine their whole crypto book, not just the affected insured, reassessing aggregate exposure, wordings and sub-limits across the portfolio,” Alan Lyons, co-chair of the insurance group at law firm Herrick, told Reuters. According to Cybersecurity Dive, the general trend for large businesses and cyber insurance has been decreasing frequency of claims but ballooning payouts, reflecting that the attacks that do get through defenses tend to be highly disruptive or damaging. The National Association of Insurance Commissioners (NAIC) wrote in a new report that the average size of claims for businesses with at least $1 billion in annual revenue was $4.4 million in 2025, or up 586% since 2021. The Financial Times reported on concerns this year that the overall insurance market may be under-priced relative to actual risk, calling out cyber insurance premiums that have fallen since 2022 despite more attacks. Marsh’s Laurent Rousseau told the paper that there’s occasionally “a huge gap between the financial performance of the industry and the underlying risk pricing.” Insurers are likely to demand that crypto firms fix any vulnerabilities related to the Binance fiasco, Reuters reported. The scrutiny could also extend to crypto firms’ broader security measures, and policies may carry new exclusions (situations where an insurer will refuse to pay out). Lyons told Reuters tighter wording and clearer exclusions are a likely outcome. Marcos Alvarez, managing director of global financial institution ratings at Morningstar DBRS, told Reuters that it had yet to be determined whether crypto insurers will pay out in a Binance-style incident. Global insurance marketplace Lloyd’s has generally required cyber policies to have exclusions for state-backed attacks since 2023, for example. “If an attack is attributed to a state, insurers ​may dispute or deny claims,” Alvarez said. “The effectiveness of these exclusions in a major, geopolitically driven loss remains untested.” “This combination of lower frequency but sharply higher severity at the top of the market might suggest that improved underwriting selection and security controls may be reducing the number of incidents reaching a claim,” NAIC wrote in the report, adding that the incidents that still occur are “becoming noticeably more expensive to resolve.” While AI-fueled attackers mean “loss ratios may deteriorate, particularly for insureds relying on common software stacks,” NAIC added, the central problem remains supply chains—the vast web of dubiously catalogued software and hardware components in any organization’s tech stack. While the Binance hack reportedly involved a fake job interview and malware in an ad, last year’s $1.4 billion Bybit heist involved a compromised third-party developer machine in the exchange’s supply chain. AI plays into cyber insurance on another level, too: scale. The FT noted that insurers are wary that AI deployment introduces systemic risk, and it’s not difficult to imagine how those concerns could also translate to cyberattacks. “The insurance industry can afford to pay a $400 million or $500 million loss to one company that has deployed AI that gave the wrong pricing on airlines, or gave the wrong healthcare diagnosis,” Aon broker Kevin Kalinich told the paper. “What they can’t afford to pay is if an AI provider makes a mistake that ends up in 1,000 or 10,000 losses—a systemic, correlated, aggregated risk.”