“Industry insiders and experts” told Reuters that underwriters should investigate whether crypto clients are vulnerable to cyber thefts, such as the alleged North Korean operation that stole $6.3 billion from global exchange Binance last week.
Jacqueline Quintal, financial institution and digital assets industry leader at insurance broker Marsh, told the agency that she would not want to be the person who renews or writes a policy for a crypto institution just to witness another massive theft. Insurance capacity, rates and coverage are unlikely to change, she added, but safety issues will. It’s easy to see how this could lead to higher hurdles for politicians or more denials of applications. Experts told Reuters that there was no insurance policy covering losses as huge as Binance’s and that the crypto industry, valued at more than $2.5 trillion, would face stricter scrutiny when policies are renewed (usually on an annual basis).
Bloomberg previously reported that Binance insured some executives against personal liability, but “unlike other crypto companies” it did not have cyber insurance.
“A loss of this magnitude prompts underwriters to re-examine their entire crypto portfolio, not just the affected policyholders, by re-evaluating the overall exposure, wordings and sub-limits of the entire portfolio,” Alan Lyons, co-chair of the insurance group at law firm Herrick, told Reuters.
According to Cybersecurity Dive, the general trend for large businesses and cyber insurance is a decrease in claim frequency but an increase in compensation, showing that attacks that get through defenses tend to be very disruptive or damaging. The National Association of Insurance Commissioners (NAIC) wrote in a new report that the average claim amount for companies with at least $1 billion in annual revenue was $4.4 million in 2025, an increase of 586% since 2021. The Financial Times reported concerns this year that the overall insurance market may be undervalued relative to real risk, calling out cyber insurance premiums that have fallen since 2022 despite more attacks.
Marsh’s Laurent Rousseau told the newspaper that there is sometimes “a huge gap between the financial performance of the industry and the pricing of the underlying risk.”
Insurers will likely demand that crypto companies patch any vulnerabilities linked to the Binance fiasco, Reuters reported. Scrutiny could also extend to crypto companies’ broader security measures, and policies could include new exclusions (situations in which an insurer will refuse to pay). Lyons told Reuters that stricter wording and clearer exclusions were a likely outcome.
Marcos Alvarez, managing director of global financial institutions ratings at Morningstar DBRS, told Reuters it had not yet been determined whether crypto insurers would pay out in the event of a Binance-style incident. Global insurance market Lloyd’s has generally required since 2023 that cybercrime policies include exclusions for state-sponsored attacks.
“If an attack is attributed to a state, insurers can dispute or deny claims,” Alvarez said. “The effectiveness of these exclusions in the event of a major loss of geopolitical origin has not yet been tested.”
“This combination of lower frequency but significantly higher severity at the top of the market could suggest that better underwriting selection and security controls could reduce the number of incidents resulting in a claim,” the NAIC wrote in the report, adding that incidents that still occur “become significantly more costly to resolve.”
While AI-powered attackers mean “claims rates may deteriorate, particularly for policyholders who rely on common software stacks,” the NAIC added, the central problem remains supply chains, the vast network of software and hardware components dubiously cataloged in any organization’s technology stack. While the Binance hack reportedly involved a fake job interview and malware in an ad, last year’s $1.4 billion Bybit heist involved a compromised third-party developer’s machine in the exchange’s supply chain.
AI also plays a role in cyber insurance at another level: scale. The FT noted that insurers are concerned that the deployment of AI will introduce systemic risk, and it is not difficult to imagine how these concerns could also translate into cyberattacks.
“The insurance industry can afford to pay a $400 million or $500 million loss to a company that deployed AI that gave bad prices to airlines or gave a bad health diagnosis,” Aon broker Kevin Kalinich told the newspaper. “What they can’t afford is if an AI vendor makes a mistake that results in 1,000 or 10,000 losses – a systemic, correlated, aggregated risk. »
Gn bussni
