Approximately $70.5 billion in total value locked across DeFi protocols carries less than 2% insurance coverage, according to data from OpenCover and Nexus Mutual. In H1 2026, crypto exploits hit a record 212 confirmed incidents, draining between $972 million and $1.32 billion depending on the tr...
"Crypto users are choosing juicy yields over protection, putting billions at risk of hacks." — Hugh Karp, Founder, Nexus Mutual
Approximately $70.5 billion in total value locked across DeFi protocols carries less than 2% insurance coverage, according to data from OpenCover and Nexus Mutual. In H1 2026, crypto exploits hit a record 212 confirmed incidents, draining between $972 million and $1.32 billion depending on the tracking firm. The gap between assets at risk and assets insured has widened, not narrowed, despite six years of protocol development.
The entire on-chain insurance sector — Nexus Mutual, InsurAce, Sherlock, Neptune Mutual, Chainproof, and roughly a dozen smaller protocols — collectively underwrites a fraction of the capital that a single mid-tier traditional reinsurer handles. Nexus Mutual, the largest on-chain provider, has covered more than $6.5 billion in cumulative value since 2019 but holds a capital pool under $200 million. The crypto insurance market was valued at $9.49 billion in 2025 by Grand View Research, but the vast majority of that figure represents off-chain custodial and exchange-level policies, not DeFi-native smart contract cover.
The structural mismatch between DeFi's risk profile and insurance capacity represents one of the sector's most persistent economic failures. Hacks are accelerating. Coverage is not.
DeFi's total value locked across all chains stood at approximately $70.5 billion as of mid-2026, down 39% from January's $115 billion, according to CoinLaw and DeFi Llama data. Of that figure, less than 2% carries any form of on-chain insurance cover. The uninsured remainder — roughly $69 billion — sits exposed to smart contract exploits, oracle manipulation, governance attacks, bridge failures, and private key compromises.
The decline in TVL itself compresses the denominator. Yet insurance coverage has not kept pace even with the smaller number. Nexus Mutual's capital pool sits near $200 million. InsurAce's active cover has contracted. Several early entrants — Cover Protocol, Armor.fi, Bridge Mutual, Tidal Finance — either collapsed or ceased operations between 2021 and 2024 due to unsustainable tokenomics, conflict-of-interest structures, and, in Cover Protocol's case, its own hack.
Ethereum's DeFi ecosystem accounts for $41.84 billion of the total as of August 8, 2026, up 7.82% over the trailing 30 days, per Blockchain Magazine data. Committed capital is growing while trading volume on top of it is shrinking — a pattern that increases the density of assets per protocol and, by extension, the severity of any single exploit.
Multiple security firms tracked H1 2026 exploit activity, with figures varying by methodology:
| Tracker | Incidents | Total Losses | Key Note | |---------|-----------|-------------|----------| | Immunefi | 207 | $972M | DeFi exploit damage down 74% from 2022 | | Blockaid | 212 | $1.1B | Highest incident count on record | | CertiK | 344 | $1.32B | Broadest methodology, includes scams | | TRM Labs | — | ~$972M | 66% attributed to North Korea-linked actors |
The two largest single exploits in H1 2026 — KelpDAO and Drift — accounted for a combined $577 million. Privileged key misuse drove $790 million in losses, according to CertiK CEO Ronghui Gu, who told Forbes the attacks were "fewer but far more surgical" than previous years.
August 2026 continued the trend. The Coldcard hardware wallet exploit drained approximately $116 million (1,816 BTC) via a five-year-old firmware flaw in Coinkite's seed generation, per TRM Labs. The Sandbox's SAND token on Base was exploited through hijacked LayerZero delegate permissions. Term Labs lost $8.5 million in a governance exploit. An August Metaverse Post analysis described the month as an "exploit wave" marked by governance failures, protocol bugs, and a widening attack surface.
North Korea-linked actors accounted for approximately $643 million — 66% of the half-year total — according to TRM Labs' H1 2026 assessment. The concentration of losses in state-sponsored theft underscores a risk category that no on-chain insurance protocol has meaningfully attempted to price.
The on-chain insurance sector comprises fewer than 10 active protocols of material size. Their combined underwriting capital represents over 90% of the industry's on-chain capacity, according to OpenCover:
Nexus Mutual remains the largest. Operating since 2019, it has covered more than $6.5 billion in cumulative value and paid out $18.5 million in claims. The protocol generated $5.7 million in cover fees in 2025 and $3.2 million in investment returns from its capital pool. Its NXM token trades at approximately $48-53, with a market capitalization of $82 million and a circulating supply of 1.72 million NXM. In November 2025, the protocol integrated restaking specialist Symbiotic to build a yield-generating reinsurance layer.
InsurAce has processed notable claims, including $11.7 million paid to 155 cover holders during the UST depeg event. Depeg-related payouts declined approximately 35% year over year.
Sherlock operates a hybrid model combining audit contest coverage with underwriting. Protocols undergoing public Sherlock audit contests receive cover at 2% of covered value; private audits at 2.5%.
Neptune Mutual uses decentralized oracles for parametric-style claim resolution, with payouts settling in minutes once an incident is verified on-chain.
Chainproof stands apart as the only protocol with traditional regulatory backing. Licensed by the Bermuda Monetary Authority, backed by Sompo, and reinsured by Munich Re, it offers regulated insurance against smart contract hacks for non-custodial positions. Its product set includes slashing insurance for proof-of-stake validators and staking yield guarantees for institutional programs.
Four structural factors explain why on-chain insurance has remained a marginal product despite six years of development and billions in cumulative losses:
1. Risk modeling limitations. Traditional insurance relies on actuarial tables built from decades of claims data. DeFi protocols are heterogeneous, constantly upgrading, and subject to novel attack vectors. A CoinDesk investigation in May 2026 found that attackers have shifted from smart contract bugs — which are at least partially modelable — to private key compromises and phishing attacks, which represent operational security failures outside the protocol's code. Insurance Business Magazine reported that crypto insurers face "a data deficit" as DeFi exposure grows, with insufficient historical claims data to accurately price risk.
2. Capital inefficiency. On-chain insurance requires overcollateralization. Nexus Mutual's capital pool must back all active cover with a probability of meeting all claims. This creates a structural ceiling: the protocol cannot write more cover than its capital base supports, and attracting capital requires competitive yields that compress underwriting margins.
3. Adverse selection and moral hazard. Users most likely to buy cover are those interacting with the riskiest protocols. Meanwhile, protocols with the strongest security postures attract users who see less need for insurance. The result is a pool skewed toward high-risk positions, which drives up premiums and further reduces demand from lower-risk participants.
4. Protocol mortality. The insurance sector has suffered its own attrition. Cover Protocol was hacked in 2020. Armor.fi, Bridge Mutual, and Tidal Finance all either flatlined or ceased operations. Each failure eroded trust in the product category itself, creating a negative feedback loop where fewer users trust insurance protocols, reducing capital inflows, and further constraining capacity.
The gap between on-chain insurance and traditional risk markets is narrowing from both directions.
From the traditional side: Evertas, backed by Lloyd's of London, offers worldwide coverage of up to $360 million per location for mining equipment. Grand View Research projects the broader crypto insurance market will reach $192.72 billion by 2033, growing at a CAGR of 45.8%. That figure encompasses custodial policies, exchange coverage, D&O insurance, and tech E&O — categories where traditional underwriters have established frameworks.
In January 2026, Dubai Insurance became the first traditional insurer to launch a cryptocurrency wallet in partnership with Standard Chartered-backed custodian Zodia Custody, allowing customers to pay premiums and receive claims in digital assets.
From the DeFi side: Nexus Mutual's Symbiotic integration aims to build a reinsurance layer that can attract yield-seeking capital from the broader restaking ecosystem. The model borrows from Lloyd's of London's syndicate structure, where members deploy assets into syndicates and receive proportional returns.
Institutional demand is real. Surveys cited by Grand View Research show approximately 70% of institutional investors prefer trading on exchanges with insurance coverage. Institutional crypto insurance grew 140% year over year through 2025, particularly after the GENIUS Act standardized proof-of-reserves and insurance disclosure requirements for U.S. exchanges.
The constraint is not demand. It is capacity. The total underwriting capital available across all on-chain and off-chain crypto insurance products remains a rounding error relative to the $70 billion in DeFi TVL, to say nothing of the broader $2.75 trillion crypto market.
The numbers illustrate the scale mismatch:
H1 2026 exploit losses alone exceeded the total cumulative claims ever paid by Nexus Mutual by a factor of 52 to 71x. Even if every dollar of Nexus Mutual's capital pool were deployed against H1 claims, it would cover 15–21% of losses.
The economic case for insurance is straightforward: annualized DeFi exploit losses run at roughly $2 billion. At a 5% premium rate, insuring $70 billion in TVL would generate $3.5 billion in annual premiums — more than sufficient to cover expected losses. The problem is not the math. It is the infrastructure to connect capital willing to underwrite risk with protocols and users willing to pay for coverage.
DeFi's insurance gap is not a new problem. It is a compounding one. Each year, TVL grows or fluctuates by tens of billions while on-chain insurance capacity inches forward by single-digit millions. The economic incentives exist: annualized losses justify premium rates that could sustain underwriting. The demand exists: 70% of institutional investors cite insurance as a prerequisite for exchange participation.
What does not exist is the infrastructure to connect these inputs at scale. On-chain protocols lack actuarial data, capital depth, and regulatory clarity. Traditional insurers lack on-chain integration, smart contract expertise, and appetite for DeFi's novel risk categories. The Chainproof model — regulated, reinsured by Munich Re, licensed in Bermuda — represents the closest approximation to a working bridge. Whether it can scale fast enough to matter is an open question.
In the meantime, the arithmetic is stark. DeFi lost more to exploits in the first half of 2026 than on-chain insurance has paid in claims across its entire history. The sector has built a $70 billion economy on a foundation that remains, by any actuarial standard, uninsured.