On-chain insurance coverage fell 20.2% to $130.2 million in the 19 months ending July 2026, according to CoinGecko's State of Crypto Security Report published August 27. During the same period, crypto platforms lost $3.63 billion to hacks across 245 documented incidents. Five of nine tracked on-c...
"The underlying security environment has not improved; in several meaningful respects, it has deteriorated." — CertiK, Hack3D H1 2026 Report
On-chain insurance coverage fell 20.2% to $130.2 million in the 19 months ending July 2026, according to CoinGecko's State of Crypto Security Report published August 27. During the same period, crypto platforms lost $3.63 billion to hacks across 245 documented incidents. Five of nine tracked on-chain insurance protocols have shut down or pivoted away from coverage entirely.
The numbers describe a protection gap that is widening, not closing. Cumulative insurance payouts stand at $33 million — 0.9% of total theft losses since January 2025. Nexus Mutual, the sector's largest protocol at $102.5 million in TVL, accounts for 84.6% of all DeFi insurance capacity. The remaining protocols split $18.7 million. For context, Binance's self-funded protection reserve of $1.16 billion is approximately nine times the entire on-chain insurance market.
This report examines the structural dynamics behind the collapse of on-chain insurance, the scale of losses it was designed to cover, and why the gap between insurable risk and available coverage continues to expand.
Active on-chain insurance coverage peaked at $163.2 million across nine tracked protocols. As of the CoinGecko report's cutoff in July 2026, that figure stood at $130.2 million — a 20.2% contraction. The decline occurred steadily, not in a single event, suggesting structural market exit rather than temporary capital rotation.
Cumulative payouts across all on-chain insurance protocols totaled $33.0 million over the full tracking period, according to CoinGecko. That figure has remained largely stagnant, indicating that few new claims are being filed or approved — a function of both restrictive coverage terms and declining active policies.
The coverage-to-loss ratio tells the sharpest story. With $3.63 billion in documented theft losses from January 2025 through July 2026, the $33 million in insurance payouts represents recovery of 0.9 cents on every dollar stolen. The on-chain insurance market, in aggregate, covered less than 1% of realized losses.
Three independent security firms tracked H1 2026 losses, each using different incident definitions:
| Tracker | Incidents | Total Losses | Period | |---------|-----------|-------------|--------| | CertiK (Hack3D) | 344 | $1.31 billion | Jan–Jun 2026 | | Blockaid | 212 | $1.1 billion | Jan–Jun 2026 | | Immunefi | 207 | $972 million | Jan–Jun 2026 |
The variance in reported figures stems from differing methodologies — CertiK counts phishing and rug pulls separately, while Immunefi excludes certain social engineering incidents. Regardless of methodology, all three trackers recorded the highest incident counts in their respective histories for a half-year period.
Two incidents dominated the period. The KelpDAO RPC compromise on April 18 drained $291.3 million. The Drift Protocol multisig breach on April 1 extracted $285.3 million in under 12 minutes. Combined, these two attacks accounted for $576.6 million — approximately 44% of CertiK's total and 52% of Blockaid's.
The top 10 incidents represented 72.5% of total stolen value, according to CoinGecko's analysis. This extreme concentration means a handful of large operational failures, not a broad degradation of smart contract quality, drove the aggregate loss figure.
April 2026 was the worst single month. CertiK detected hacking incidents on all but three days that month. Losses exceeded $651 million across 61 incidents.
CoinGecko tracked nine on-chain insurance protocols at the start of its monitoring period. By August 2026, five had either ceased operations or pivoted to non-insurance product lines. Neptune Mutual announced in 2025 that it was winding down operations, citing "insufficient growth across the DeFi insurance sector." The protocol's exit was notable because it occurred during a period of rising demand for coverage — losses were increasing, but the economics of providing that coverage remained unviable.
The attrition pattern is consistent with a market where the cost of underwriting exceeds the premium revenue collectible from users. Smart contract exploit coverage — the most commonly offered product — requires underwriters to price risk in an environment where a single incident can drain the entire capital pool. Traditional insurance spreads catastrophic risk across thousands of uncorrelated policies. DeFi insurance concentrates it.
The surviving protocols have narrowed their coverage offerings. Claims are typically limited to verified smart contract exploits or specific infrastructure failures. Coverage for private key compromise, social engineering, bridge failures, or oracle manipulation — categories that account for the majority of 2026 losses — is either excluded or priced at prohibitive premiums.
The economics of on-chain insurance underwriting present a structural problem. Capital providers (stakers who lock assets to back coverage) face asymmetric risk: they earn premium yields typically ranging from 2-5% APY while facing potential total loss of staked capital if a covered protocol is exploited.
This risk-return profile competed poorly against alternatives in 2025-2026. Treasury yields remained above 4.5% following the Fed's hawkish stance at Jackson Hole. DeFi lending rates on major protocols offered comparable yields without exploit exposure. The rational capital provider exited insurance staking for lower-risk, comparable-return alternatives.
Premium pricing created a secondary barrier. To attract capital providers at sufficient scale, protocols needed to charge premiums that reflected actual exploit probability. But higher premiums deterred buyers, reducing the revenue pool, which in turn drove out capital providers — a reflexive cycle that compressed the market from both sides.
Coverage scope restrictions compounded the problem. As the data shows, wallet compromise ($445 million in H1 2026 losses, per CertiK), phishing ($366 million), and infrastructure attacks ($1.8 billion over 19 months) accounted for the majority of losses. Most on-chain insurance products do not cover these categories. Users purchasing coverage discovered that the most likely loss scenarios fell outside policy terms, reducing the perceived value of coverage and suppressing demand further.
The composition of attack vectors in H1 2026 explains why traditional DeFi insurance products are structurally misaligned with actual risk.
CertiK's data shows wallet compromise generated $445 million in losses across 33 incidents — an average of $13.5 million per incident. Phishing produced $366 million across 63 incidents. Code vulnerabilities, the category most commonly covered by insurance, accounted for $152 million across 204 incidents — the lowest per-incident severity at $745,000 average.
The implication is clear: the risk category that insurance is designed to cover (code bugs) represents the smallest share of losses by dollar value. The largest loss categories (key compromise, infrastructure attacks, social engineering) fall outside standard coverage terms.
DPRK-linked groups were responsible for approximately $643 million in H1 2026 theft — 66% of total losses tracked by TRM Labs. These state-sponsored actors primarily use social engineering and infrastructure compromise rather than smart contract exploits. No on-chain insurance product covers nation-state attack vectors.
An additional concern flagged by Blockaid: code vulnerability incidents targeting contracts older than one year increased from 7 per month in October 2025 to 18 per month by May 2026. Aging smart contracts that passed initial audits are accumulating undiscovered vulnerabilities — a long-tail risk that current insurance pricing models do not adequately capture.
Nexus Mutual holds $102.5 million in TVL as of August 2026, per DefiLlama. This represents 84.6% of the $121.1 million tracked across 32 insurance-category protocols. The next largest protocol holds a fraction of that figure. InsurAce, which once reported $150 million in TVL, has contracted to approximately $132,000 — a near-total collapse.
The concentration creates systemic risk within the insurance layer itself. If Nexus Mutual were to face a large claim that drained its capital pool, the entire on-chain insurance market would effectively cease to exist. The protocol has paid out $18.5 million in claims since its 2019 launch and reports having covered over $6.5 billion in cumulative digital asset value — but active coverage at any given time represents a small fraction of that cumulative figure.
Nexus Mutual's NXM token traded at approximately $49.66 in late August 2026. The token's bonding curve mechanism ties its price to the protocol's capital pool, meaning any significant capital outflow from claim payments would mechanically depress the token price, potentially triggering further capital exit.
In the absence of functional on-chain insurance markets, larger entities have adopted alternative risk management approaches.
Binance maintains a $1.16 billion self-funded Secure Asset Fund for Users (SAFU) — roughly nine times the entire on-chain insurance market. This reserve is designed to cover user losses from security breaches without relying on external insurance. The approach works for entities with sufficient balance sheet depth but offers nothing to smaller protocols or individual users.
Nayms, operating on Base (Ethereum L2), has structured tokenized reinsurance facilities that connect on-chain capital with traditional insurance risk. Its Industry Loss Warranty product for Florida windstorm coverage represents an attempt to bridge blockchain capital markets with actuarially modeled real-world risk. The approach inverts the typical DeFi insurance model: rather than insuring crypto-native risk with crypto capital, it uses crypto rails to access traditional insurance markets.
Wyoming's regulatory framework, which allows insurers to hold digital assets and recognizes DAOs as legal entities, provides a jurisdictional foundation for hybrid insurance models. Vermont's captive insurance sandbox similarly supports blockchain experimentation by regulated insurers.
These developments suggest the future of crypto risk transfer may not be pure on-chain mutual insurance but rather hybrid structures that connect blockchain-native capital with traditional actuarial frameworks and regulatory oversight.
The on-chain insurance market is contracting precisely when it is most needed. The $130.2 million in active coverage represents less than 0.1% of total DeFi TVL, a ratio that would be considered a systemic failure in any traditional financial market. The protection gap is not narrowing — it is widening as losses scale faster than coverage capacity.
The structural problems are not easily resolved. Underwriting crypto exploit risk requires capital providers to accept tail risk with inadequate premium compensation. The shift in attack vectors toward social engineering and infrastructure compromise has rendered the most common coverage products — smart contract exploit insurance — increasingly irrelevant to actual loss patterns.
The market appears to be bifurcating. Large centralized entities self-insure through balance sheet reserves. Hybrid models like Nayms attempt to connect blockchain capital with traditional reinsurance structures. Pure on-chain mutual insurance, the original DeFi insurance thesis, is consolidating toward a single protocol (Nexus Mutual) that carries both the opportunity and the systemic risk of market dominance.
For the broader Web3 ecosystem, the insurance gap represents a measurable barrier to institutional adoption. Risk transfer is a prerequisite for institutional capital deployment at scale. Until the crypto industry develops economically viable insurance mechanisms — whether on-chain, hybrid, or traditional — the $130 million in available coverage will remain a rounding error against billions in annual losses.