The crypto industry absorbed $1.64 billion in hack losses during Q1 2026 alone, according to Immunefi. CertiK tallied $480 million across 103 security incidents and 36 phishing scams year-to-date. Meanwhile, on-chain insurance protocols collectively cover less than $500 million in total value — u...
"We're seeing somewhere between $120 billion and $160 billion of assets sitting in DeFi today, and about 95 to 98% of those are uninsured." — Alex Krasnow, Blockchain and Web3 Insurance Advisor, IMA Financial Group
The crypto industry absorbed $1.64 billion in hack losses during Q1 2026 alone, according to Immunefi. CertiK tallied $480 million across 103 security incidents and 36 phishing scams year-to-date. Meanwhile, on-chain insurance protocols collectively cover less than $500 million in total value — under 0.5% of the estimated $100-160 billion locked in DeFi. The gap between what is at risk and what is protected has never been wider.
Two parallel tracks are now visible. On-chain native protocols like Nexus Mutual, which has underwritten $6 billion in cumulative coverage since 2019, are scaling parametric products tied to smart contract failures, depegs, and custody loss. Traditional insurers, led by Lloyd's coverholder Evertas and broker Aon — which executed the first known stablecoin premium payment in March 2026 — are moving cautiously into digital asset exposure. Neither track covers more than a fraction of the risk surface. The DeFi insurance market, valued at roughly $3.5 billion in 2025, remains structurally undersized relative to the capital it aims to protect.
The first quarter of 2026 produced some of the largest loss totals in crypto history.
Immunefi's Q1 report documented $1.64 billion stolen across 40 incidents. The Bybit exchange hack in February — attributed to North Korea's Lazarus Group and valued at $1.46 billion — accounted for roughly 89% of the total. Excluding that outlier, DeFi-specific losses totaled $106.8 million across 38 incidents.
CertiK's parallel tracking yielded $480 million in cumulative losses from 103 security incidents and 36 phishing scams as of late March 2026. January alone accounted for $370.3 million, marking the highest monthly total in 11 months — nearly four times January 2025's $98 million figure.
Attack vectors shifted. Phishing and social engineering accounted for approximately $311 million of CertiK's total, driven by a single incident on January 10 where one victim lost $282 million in Bitcoin and Litecoin through hardware wallet social engineering. The top five protocol-level exploits — Step Finance ($27.3 million), Resolv ($26.8 million), Truebit ($26.6 million), Swapnet ($13.3 million), and YieldBlox ($10.5 million) — combined for $104.5 million.
BNB Chain surpassed Ethereum as the most targeted network, suffering 19 attacks in Q1 versus Ethereum's 15, according to Immunefi data. Base recorded three incidents; Optimism and Arbitrum each saw two.
Against this loss backdrop, on-chain insurance coverage remains negligible.
ABC Money reported in March 2026 that less than 0.5% of the approximately $100 billion in DeFi TVL carries any form of insurance protection. Total value covered (TVC) across all on-chain insurance protocols sits at roughly $500 million. Insurance Business Magazine cited Alex Krasnow of IMA Financial Group estimating $120-160 billion in DeFi assets with 95-98% uninsured.
The coverage ratio — insurance capacity divided by insurable assets — stands somewhere between 0.3% and 0.5%. For comparison, traditional commercial property insurance in the U.S. covers approximately 95% of insurable assets, according to industry benchmarks.
The types of risk that do get covered remain narrow. Smart contract exploit coverage, custody loss, and stablecoin depeg events represent the bulk of on-chain insurance products. Oracle manipulation, governance attacks, bridge failures, and economic design flaws — all sources of material losses in Q1 — sit largely outside available coverage.
As Jesus Rodriguez, co-founder of Sentora, told ABC Money: "DeFi built the engine but forgot the brakes."
Nexus Mutual remains the dominant on-chain insurance protocol. Founded in 2019 by former actuary Hugh Karp, the Ethereum-based mutual has underwritten over $6 billion in cumulative coverage and paid $18-19 million in claims. Its capital pool holds approximately $190 million, with active cover near $194 million.
Nexus Mutual accounts for over 68% of on-chain insurance TVL, per DeFi Llama data. In November 2025, the protocol integrated with restaking specialist Symbiotic to create underwriting vaults aligned with cover durations, enabling real-time capital reallocation. Cover can be purchased in ETH, USDC, or cbBTC terms.
Yet even Nexus Mutual's dominance is relative. Its $194 million in active cover represents approximately 0.2% of DeFi's total value locked. The protocol's own documentation acknowledges that the Minimum Capital Requirement mechanism constrains the volume of new covers it can underwrite at any given time.
Etherisc has taken a different path, focusing on parametric insurance — policies that trigger payouts automatically when predefined conditions are met. The protocol has issued more than 10,000 policies since 2021, primarily for crop insurance and flight delay coverage across 15+ countries, with more than $13 million in decentralized flight delay coverage.
Neptune Mutual, another entrant, reached a TVL of nearly $13 million, offering coverage against exchange and protocol exploits. The protocol uses a parametric model where payouts are triggered by incident reports ratified by governance, avoiding the subjective claims-assessment process that slows traditional insurance.
Collectively, DeFi insurance platforms covered $610 million in claims during 2025, according to CoinLaw statistics. DAO treasury security budgets grew 32% in the same year, with funds directed toward audits, monitoring, and infrastructure rather than insurance premiums — a signal that many protocols still treat security spending as a substitute for risk transfer.
The traditional insurance industry's engagement with crypto risk is accelerating, albeit from a minimal base.
On March 9, 2026, Aon plc — the $45 billion global insurance broker — executed the first known stablecoin insurance premium payment among major brokers. The proof of concept used USDC on Ethereum and PayPal USD (PYUSD) on Solana, settling premium payments for clients Coinbase and Paxos. Aon cited the GENIUS Act, passed in 2025, as establishing the federal stablecoin framework that supported the transaction.
Evertas, the only crypto-specialized insurance company backed by Lloyd's of London, offers policy limits up to $360 million per declaration — the highest in the industry. Evertas currently covers mining operations responsible for 25% of Bitcoin's hashrate and provides coverage for crime, theft, private key loss, platform failure, insider theft, and Directors & Officers liability. In 2024, Lloyd's enabled Evertas policies to be arranged and paid for on the Ethereum blockchain via smart contract provider Nayms.
Canopius, another Lloyd's market insurer, has expanded into digital asset coverage targeting exchanges and large-scale crypto operations.
These traditional players bring institutional-grade capital and risk modeling. But their approach differs fundamentally from on-chain protocols. Traditional crypto insurance policies are negotiated bilaterally, denominated in fiat, subject to standard claims processes, and carry exclusions that may not map cleanly to on-chain risk events. The pricing remains opaque. According to Krasnow, the skills gap between traditional underwriters and crypto-native risk assessors continues to constrain available capacity: "Until underwriting teams reach the same deep technical understanding as crypto-savvy players, it's hard for them to offer competitive policies."
Five structural factors explain why DeFi insurance penetration has stalled below 1%.
Data scarcity. Traditional insurance relies on actuarial tables built from centuries of loss data. Crypto insurance has approximately 10 years of data. "While they have 300-plus years of data in real estate or property insurance, we've got about 10 years of data at the max," Krasnow told Insurance Business Magazine. "Data is the number one impediment."
Correlated risk. First-generation on-chain insurance protocols used tokens from the same ecosystem as collateral. When a major exploit occurs, the collateral depreciates simultaneously with the claim obligation — a reflexivity trap identified by Rodriguez in his March 2026 analysis. Insurance capital backed by the same assets it insures fails precisely when it is needed.
Pricing opacity. No standardized mechanism exists for pricing protocol security risk. Two DeFi lending protocols with similar TVL may carry vastly different smart contract risk profiles, but the market lacks transparent pricing signals to differentiate them. Without accurate risk pricing, premiums either overcharge low-risk protocols or undercharge high-risk ones — both outcomes suppress adoption.
Capital formation. On-chain insurance requires patient, yield-seeking capital willing to accept modest returns in exchange for underwriting exposure. This capital competes with DeFi lending, staking, and liquidity provision, all of which offer more predictable returns. The result: chronic undercapitalization of insurance pools.
Regulatory ambiguity. On-chain insurance products exist in a regulatory gray zone. They are not licensed insurance products in most jurisdictions, which limits institutional participation. The Allied Market Research projection of $135.6 billion in decentralized insurance by 2032 (58.5% CAGR from a $1.4 billion base in 2022) assumes regulatory frameworks that do not yet exist.
The February 2025 Bybit hack — the largest single crypto theft in history at $1.46 billion — illustrates the insurance gap in practice.
North Korea's Lazarus Group exploited a vulnerability in Safe Wallet's user interface to manipulate Bybit's multi-signature process. The stolen ETH was swapped and dispersed across thousands of addresses on multiple blockchains via THORChain. The FBI attributed the attack to North Korea's TraderTraitor group.
Bybit held no known insurance policy covering the stolen assets. Recovery depended on emergency measures: nearly 447,000 ETH were secured through loans from Galaxy Digital, FalconX, and Wintermute. Bybit offered a 10% bounty for fund return. According to CNBC, the exchange replenished its reserves within days, but no insurance payout was involved.
The incident underscored a fundamental asymmetry: the crypto industry's largest single-point-of-failure events exceed the entire capitalization of on-chain insurance protocols. Nexus Mutual's $190 million capital pool would cover approximately 13% of the Bybit loss. Evertas's $360 million maximum policy limit would cover 25%. No existing product — on-chain or traditional — could have made Bybit whole.
The DeFi insurance market is caught between two metrics that move in opposite directions. Loss totals are rising: $1.64 billion in Q1 2026 represents a pace that would exceed any full-year total on record. Coverage ratios are static or declining: the sub-0.5% penetration rate has not meaningfully improved despite six years of on-chain insurance protocol development.
The decentralized insurance market, projected at $3.5 billion for 2025, would need to expand roughly 30x to cover even 10% of current DeFi TVL. That scaling requires solving for capital formation, risk pricing, and regulatory clarity simultaneously — problems that traditional insurance took decades to address.
Aon's stablecoin premium experiment and Evertas's Lloyd's integration suggest that the insurance industry recognizes the opportunity. Whether institutional capital arrives before the next billion-dollar exploit remains the open question. The infrastructure for risk transfer in crypto remains, by the data, materially underdeveloped relative to the capital it is supposed to protect.