On-chain insurance coverage for crypto assets fell 20.2% to $130.2 million as of August 2026, down from $163.2 million, according to CoinGecko's 2026 State of Crypto Security Report published August 27. During the same 19-month window (January 2025 through July 2026), the industry recorded $3.63 ...
"Security remains a top priority in crypto, yet losses keep climbing. Over $3.6B was stolen since 2025 through threats like private key compromise and smart contract exploits." — CoinGecko Research, 2026 State of Crypto Security Report
On-chain insurance coverage for crypto assets fell 20.2% to $130.2 million as of August 2026, down from $163.2 million, according to CoinGecko's 2026 State of Crypto Security Report published August 27. During the same 19-month window (January 2025 through July 2026), the industry recorded $3.63 billion in losses across 245 documented incidents. Insurance covered approximately 0.9% of total losses.
Five of the nine on-chain insurance protocols tracked by CoinGecko have either shut down or pivoted away from crypto coverage entirely. The remaining four — led by Nexus Mutual, which holds 84.6% of the insurance category's $121.1 million in TVL on DefiLlama — are operating in a market where cumulative claims payouts have stagnated at $33.0 million. The math is straightforward: capital providers face asymmetric risk, premiums remain elevated at 2–5% of insured value annually, and demand has not scaled to match loss exposure.
Traditional insurers, including Lloyd's of London syndicates, have entered the market selectively. Marsh introduced an $825 million custody coverage facility backed by Lloyd's syndicates and London-based insurers. But the aggregate capacity across both on-chain and off-chain products remains a fraction of the roughly $2.7 trillion crypto market capitalization. An estimated 89% of crypto holders remain uninsured.
The disparity between crypto losses and insurance coverage defines the current state of the market:
| Metric | Value | Source | |--------|-------|--------| | Total crypto market cap (Sept. 12, 2026) | $2.73 trillion | CoinGabbar | | Losses from hacks (Jan 2025–Jul 2026) | $3.63 billion | CoinGecko | | Active on-chain insurance coverage | $130.2 million | CoinGecko | | Insurance as % of losses | ~0.9% | Calculated | | Cumulative on-chain claims paid | $33.0 million | CoinGecko | | On-chain insurance protocols active | 4 of 9 | CoinGecko | | Estimated uninsured crypto holders | ~89% | CoinDataFlow | | Insurance category TVL (DefiLlama) | $121.1 million | DefiLlama |
The $130.2 million in active coverage represents 0.005% of total crypto market capitalization. For comparison, the U.S. property and casualty insurance industry covers approximately 95% of residential properties. The structural gap in crypto insurance is not narrowing — it is widening as market capitalization grows and coverage contracts.
CoinGecko tracked nine on-chain insurance protocols through August 2026. Five have either ceased operations or redirected their business models away from crypto coverage. The report does not name all five, but the broader DeFi shutdown trend provides context: 101 crypto projects ceased operations or went inactive in the first seven months of 2026, with more than half being DeFi protocols, according to CryptoBriefing.
The four remaining active protocols are dominated by Nexus Mutual, which accounts for 84.6% of the insurance category's total value locked on DefiLlama. Nexus Mutual's capital pool holds approximately $102.45 million. Its NXM token trades at $60.43 with a circulating market cap of $102.41 million. Since 2019, the protocol reports having protected over $6 billion in digital assets and paid out $18 million in claims.
InsurAce, the second-largest protocol, offers multi-chain coverage across Ethereum, Binance Smart Chain, Avalanche, and other networks. It has reportedly grown premiums 35% year over year, driven primarily by demand following stablecoin depeg events.
The remaining protocols in the category are significantly smaller. The entire DefiLlama insurance category — 28 tracked protocols — holds $121.1 million in TVL, a figure that represents 0.16% of the roughly $76 billion in total DeFi TVL.
Hack and exploit tracking organizations report slightly different totals due to methodological differences, but the order of magnitude is consistent:
CoinGecko's report found that the top 10 largest attacks accounted for more than 72.5% of the total value stolen. This concentration means that a small number of catastrophic events drive the majority of losses — precisely the scenario that insurance markets are designed to address, and precisely where crypto insurance capacity is absent.
A critical finding: 60% of hacked platforms had undergone security audits prior to their exploit. Audits are a necessary but insufficient condition for security. Insurance underwriters increasingly recognize that audit completion does not materially reduce actuarial risk.
Traditional insurers have moved into crypto coverage, but with narrow scope and limited capacity:
Lloyd's of London: Syndicates including Arch, Atrium, Beazley, and Canopius have begun underwriting crypto risks. Lloyd's identifies private-key security, hot and cold storage ratios, code change procedures, cyber risk, and technology breakdowns as key underwriting considerations.
Marsh: Launched an $825 million facility for digital asset custodians, backed by Lloyd's syndicates and London-based international insurers. Coverage applies primarily to assets held in cold storage or secured via Multi-Party Computation (MPC). The facility addresses natural disasters, physical theft, and insider threats — not smart contract exploits.
Evertas: Operates as the only crypto-native insurance company selected by Lloyd's as a listed coverholder.
Broader market: AXA, AIG, and Chubb have entered crypto insurance on a limited, selective basis. Corgi launched a Digital Assets Coverage Endorsement for Directors & Officers policies in 2026, addressing blanket digital asset exclusions in standard D&O policies.
The crypto insurance market totaled roughly $1.9 billion in premiums written in 2024, according to industry estimates, against a total addressable crypto market valued at approximately $2.5 trillion at the time. Market projections suggest growth from $9.5 billion in 2025 to $192.7 billion by 2033, representing a 45.8% compound annual growth rate. These projections should be treated with caution; they assume sustained institutional adoption and regulatory clarity.
Premiums for institutional cryptocurrency coverage range from 2% to 5% of insured value annually, according to multiple industry sources. Concrete figures:
At 2–5% annual premiums, a protocol with $100 million in TVL would pay $2 million to $5 million per year for coverage. Given that many DeFi protocols generate annual fee revenue below these thresholds, insurance is economically unviable for a large segment of the market.
Capital providers face the inverse problem. Underwriting crypto risk requires locking capital against potential claims in a market where single incidents can exceed $100 million. The Bybit hack alone — $1.5 billion — would have exhausted the entire on-chain insurance market's capital pool more than 11 times over.
The practical utility of existing crypto insurance is limited by extensive exclusion lists. According to CryptoTraceLabs and industry policy reviews, standard crypto insurance policies typically exclude:
On-chain coverage is generally restricted to verified smart contract exploits or infrastructure failures. Since private key compromises — not smart contract bugs — now account for the majority of stolen value, the most common loss vector falls outside the scope of most policies.
The February 2025 Bybit hack, in which North Korea's Lazarus Group stole approximately $1.5 billion in ETH, provided the clearest demonstration of the insurance gap's consequences. No single insurer or syndicate had capacity to cover losses at that scale.
Bybit survived through balance sheet strength, not insurance. Within two days, the exchange received $1.23 billion in ETH through bridge loans, whale deposits, and over-the-counter purchases. A proof-of-reserves audit by Hacken confirmed that Bybit restored 100% collateralization across BTC, ETH, SOL, USDT, and USDC.
Bybit offered a 10% bounty for recovery of stolen funds. As of late February 2025, approximately $195 million (14.5% of stolen assets) had been moved by the attackers. The precedent is clear: major exchanges must self-insure through reserves, as external coverage is structurally unavailable at relevant scale.
The insurance market has bifurcated into two segments with different risk profiles:
Custodial coverage (traditional insurers): Covers assets held by custodians, exchanges, and institutional wallets. Capacity is growing, led by the Marsh facility at $825 million and Lloyd's syndicate participation. Underwriting relies on operational security assessments — cold storage ratios, MPC implementation, employee background checks, and regulatory compliance. Regulated exchanges receive more favorable terms.
Protocol-level coverage (on-chain insurance): Covers smart contract failures, oracle manipulation, and specific technical exploits. Capacity is shrinking, with total on-chain coverage at $130.2 million. Underwriting relies on code audit history, TVL stability, and protocol-specific risk parameters set by capital pool participants.
The gap between these segments is significant. Custodial coverage addresses the needs of centralized entities with identifiable counterparties and regulated operations. Protocol-level coverage attempts to underwrite permissionless, pseudonymous systems where risk assessment depends on code analysis rather than counterparty evaluation. The latter faces fundamental actuarial challenges that traditional insurance models were not designed to address.
The crypto insurance market is contracting at the moment it is most needed. Loss volumes remain above $1 billion per half-year. On-chain insurance capacity is falling. Five of nine tracked protocols have exited the market. The remaining providers cover less than 1% of documented losses.
Traditional insurers are entering, but their products address custodial risk — assets held by regulated entities in cold storage. The vast majority of DeFi protocol risk, smart contract exposure, and private key compromise remains structurally uninsurable under current models.
The economic value question is straightforward: who bears the cost when exploits occur? In the current market, the answer is overwhelmingly the end user. Protocol treasuries, exchange reserves, and individual wallets absorb losses directly. Insurance, in both its on-chain and traditional forms, functions as a marginal risk transfer mechanism rather than a systemic safety net.
Until the insurance market develops capacity that matches the scale of losses — or until security practices reduce loss frequency below actuarially sustainable thresholds — the crypto industry operates with an implicit self-insurance model. The $130.2 million in active coverage against a $2.73 trillion market is not a gap. It is a structural absence.