Less than 2% of DeFi's $83 billion in total value locked carries any form of insurance coverage. Active on-chain insurance fell 20.2% from $163.2 million to $130.2 million between January 2025 and July 2026, according to CoinGecko's 2026 State of Crypto Security Report published August 27. Five o...
"Continued exploits reinforce to global fintechs and institutions that decentralized finance is still not ready for prime time." — Nikhil Raghuveera, CEO, Predicate
Less than 2% of DeFi's $83 billion in total value locked carries any form of insurance coverage. Active on-chain insurance fell 20.2% from $163.2 million to $130.2 million between January 2025 and July 2026, according to CoinGecko's 2026 State of Crypto Security Report published August 27. Five of the nine on-chain insurance protocols CoinGecko tracks have shut down or pivoted away from crypto coverage entirely.
The decline in protection capacity is occurring against a backdrop of accelerating losses. Hackers have taken approximately $1.4 billion across 250 attacks year-to-date in 2026, per DefiLlama data. In a 19-month span from January 2025 through July 2026, cumulative hack losses reached $3.63 billion, while cumulative insurance payouts totaled roughly $33 million — a coverage ratio of 0.9%.
The numbers describe a market where risk is growing, protection is shrinking, and capital providers are leaving. The insurance gap is no longer a future concern. It is a structural feature of the current DeFi economy.
DeFiLlama lists 28 insurance protocols. Their combined total value locked stands at approximately $123.5 million, which represents 0.14% of DeFi's broader $83 billion market. Nexus Mutual alone accounts for 84.6% of the insurance sector's TVL at $197.88 million (measured by capital pool, versus the lower active coverage figure).
At the November 2021 peak, DeFi insurance protocol value reached $1.89 billion. The current $123.5 million figure represents a 93.5% drawdown from that high.
Active coverage — the dollar amount of risk actually underwritten at any given moment — tells an even starker story. CoinGecko's August 2026 report measured active on-chain coverage at $130.2 million, down from $163.2 million at the start of 2025, a 20.2% contraction. Against $83 billion in DeFi TVL, $130.2 million in active cover means roughly $0.16 in insurance exists for every $100 deposited in DeFi protocols.
| Metric | Value | Source | |--------|-------|--------| | DeFi TVL | $83B | DefiLlama | | Insurance sector TVL | $123.5M | DefiLlama | | Active on-chain coverage | $130.2M | CoinGecko | | Insurance-to-TVL ratio | <0.2% | Calculated | | Peak insurance TVL (Nov 2021) | $1.89B | CoinInsider | | Drawdown from peak | 93.5% | Calculated |
Five of nine on-chain insurance protocols tracked by CoinGecko have either ceased operations or redirected their business away from crypto coverage as of August 2026. Neptune Mutual, which pioneered parametric DeFi insurance using oracle-confirmed triggers and automatic smart contract payouts, announced in 2025 that it was winding down operations, citing "insufficient growth across the DeFi insurance sector."
The failures share common characteristics. Capital providers face asymmetric risk: they earn premium yields of 2-3% annually on staked capital, but face potential total loss in the event of a covered exploit. When DeFi yields on lending and liquidity provision routinely exceed these premium rates, rational capital flows away from insurance underwriting toward higher-returning DeFi strategies.
Matthew Pinnock, COO of Altura, described the structural fragility: "When exploits hit, the capital backing the cover was often exposed to the same risks as the underlying protocol, so it evaporated precisely when it was needed most." Gaspard Peduzzi, founder of Spectra Finance, put it more bluntly: "You were just stacking counterparty risk on top of the counterparty risk."
The result is a reflexive cycle. As protocols fail and coverage shrinks, user confidence in insurance products erodes, further reducing demand and making it harder for surviving protocols to attract underwriting capital.
The $1.4 billion stolen across 250 attacks in 2026 compares to $2.7 billion across 146 attacks in 2025, per DefiLlama data cited by Bloomberg. While the total dollar value is lower year-on-year, the attack count has increased 71%, indicating more frequent incidents across a broader surface area.
The top 10 incidents in the January 2025–July 2026 period accounted for 72.5% of total stolen value, per CoinGecko. Infrastructure and supply-chain attacks represented $1.8 billion of the total, and private key compromise remained the single largest attack vector by dollar value.
Notable 2026 incidents include:
Twenty-six of the 250 attacks in 2026 — over 10% — targeted bridges and cross-chain infrastructure, up from three such incidents in all of 2025. This nine-fold increase in cross-chain attacks reflects the growing complexity and attack surface of multi-chain architectures.
Nexus Mutual, founded by Hugh Karp in 2019, has emerged as the de facto sole survivor of meaningful scale in on-chain DeFi insurance. Karp has described the insurance coverage gap as "one of the largest barriers to real DeFi adoption."
The protocol has covered more than $6.5 billion in cumulative value and paid out $18.5 million in claims since inception. Its capital pool — the assets staked by NXM token holders to back coverage — fluctuates between $167 million and $288 million. Active coverage underwritten currently stands around $194 million.
Nexus Mutual operates a discretionary model: token holders stake capital, review claim evidence, and vote on outcomes. This model supports wide coverage flexibility but typically requires several weeks for claim resolution. The protocol covers smart contract exploits, stablecoin depegging, validator slashing, bridge risk, oracle risk, and liquidity provision risk.
However, Nexus Mutual's dominance is itself a concentration risk. A single protocol backing 84.6% of the insurance sector's TVL means the sector's viability is tethered to one entity's solvency, governance, and operational continuity. A severe exploit affecting multiple covered protocols simultaneously could exceed the capital pool's capacity.
Off-chain, traditional insurance markets are cautiously entering the space, but at institutional scale and pricing that excludes most retail DeFi users.
Evertas, the only crypto insurance company selected as a Lloyd's of London listed coverholder, offers seven policy types spanning theft, insider fraud, hardware damage, and directors and officers liability. Coverage limits reach up to $600 million per declaration. Policies carry AM Best A- (IX — Excellent) and S&P A+ (XV — Superior) creditworthiness ratings. Customers include mining operations, crypto custodians, exchanges, investment funds, and family offices.
Binance maintains a $1.16 billion protection reserve — essentially self-insurance — funded from platform revenues.
These institutional solutions do not reach the average DeFi user depositing funds into a lending protocol or liquidity pool. The gap is not merely one of total coverage capacity; it is a distribution problem. Off-chain insurance requires KYC, minimum policy sizes, and underwriting processes incompatible with permissionless DeFi participation.
Dan She, senior audit partner at CertiK, identified the core behavioral issue: "Most DeFi users are yield-driven and do not want to give up several percentage points of return for cover."
The economics support this behavior, at least on an individual basis. Typical DeFi insurance premiums run 2-3% annually. For a user earning 8% on a lending protocol, insurance reduces the net yield to 5-6%. In an environment where the probability of any single protocol being exploited in a given year remains relatively low (though the aggregate probability across the ecosystem is high), individual users rationally choose to forgo coverage.
This creates a tragedy-of-the-commons dynamic. Each individual user's decision to skip insurance is rational, but the collective result is an ecosystem where billions in value sit unprotected. When a major exploit occurs, losses are borne entirely by depositors, with no socialized risk-sharing mechanism in place.
The contrast with traditional finance is stark. Bank deposits carry FDIC insurance up to $250,000 per depositor. Brokerage accounts carry SIPC protection up to $500,000. These protections are mandatory and embedded in the infrastructure. DeFi has no equivalent, and voluntary uptake remains near zero.
The insurance industry's difficulty with DeFi extends beyond user behavior. Several structural barriers prevent efficient risk pricing:
1. Data deficit. Insurance Business Magazine reported in 2026 that crypto insurers face a fundamental data problem. Traditional actuarial models rely on decades of claims history. DeFi's history spans approximately six years, with rapidly evolving attack vectors. AI-fueled attacks are changing the threat landscape, with Oded Blatman, Ledger's newly appointed CIO/CSO, noting that attacks are "much more sophisticated and with greater scale."
2. Correlated risk. DeFi protocols share infrastructure — oracles, bridges, common smart contract libraries. An exploit in shared infrastructure can trigger simultaneous claims across multiple covered protocols, producing correlated losses that violate the independence assumptions underlying insurance risk models.
3. Operational vs. smart contract risk. Stolen private keys — an operational security failure, not a code vulnerability — now constitute the largest attack vector by dollar value. DeFi insurance protocols designed to cover smart contract bugs struggle to price and cover human operational failures.
4. Reflexive capital dynamics. Insurance capital in DeFi is typically denominated in the same volatile assets it aims to protect. During market stress — precisely when claims are most likely — the value of the capital pool may decline simultaneously with the event triggering claims.
The DeFi insurance market is contracting while the attack surface it is meant to protect is expanding. This is not a temporary dislocation. The economics of underwriting DeFi risk — low premiums, correlated losses, volatile collateral, and a short actuarial history — have proven insufficient to sustain a decentralized insurance sector at scale.
The $130.2 million in active on-chain coverage against $83 billion in DeFi TVL represents a protection gap of approximately 99.8%. For context, uninsured losses in 2026 alone already exceed the total active coverage pool by a factor of ten.
Institutional alternatives exist but serve a narrow market. Evertas can write $600 million policies for custodians and exchanges. Binance self-insures with a $1.16 billion reserve. These options do not extend to the permissionless DeFi ecosystem where the majority of exploits occur.
Until the structural barriers to DeFi insurance are addressed — data scarcity, correlated risk, operational attack vectors, and capital competition from yield farming — the coverage gap will persist. The market is pricing DeFi risk through post-exploit losses rather than through pre-funded insurance mechanisms. Whether this constitutes a market failure or an efficient outcome remains an open question. What the data shows unambiguously is that the gap is widening, not closing.