Insurers Rethink Crypto Coverage After $6.3B Binance Heist

Underwriters are about to start asking uncomfortable questions. Industry insiders and experts tell Reuters that insurers will investigate whether crypto clients are sitting ducks for the kind of cyber heist that drained $6.3 billion from Binance last week — an operation suspected to be North Korean. The scrutiny lands hardest at renewal time, which for most crypto firms comes around once a year.

Marsh's Jacqueline Quintal told Reuters she wouldn't want to be the person who writes or renews a crypto policy only to watch another massive theft unfold. Capacity, pricing and coverage probably won't shift, she said — but security questions will, and that could mean higher hurdles for policies or more rejected claims. Bloomberg has reported that Binance insures some executives against personal liability but, unlike other crypto companies, went without cyber insurance.

The blast radius isn't limited to Binance. Alan Lyons of law firm Herrick told Reuters that a loss this size pushes underwriters to re-examine their entire crypto book, not just the affected client — reassessing aggregate exposure, wordings and sub-limits across the portfolio. Tighter policy language and clearer exclusions are the likely result. The crypto industry, worth more than $2.5 trillion, is facing tougher scrutiny as it renews.

The numbers explain the nerves. The National Association of Insurance Commissioners says the average claim for businesses with at least $1 billion in annual revenue hit $4.4 million in 2025, up 586% since 2021. The Financial Times has flagged worries that the broader market is underpriced relative to actual risk, pointing to cyber premiums that have slid since 2022 even as attacks piled up. Marsh's Laurent Rousseau told the paper there is sometimes a huge gap between the industry's financial performance and how its underlying risk is priced.

Whether insurers will actually pay out on a Binance-style disaster is an open question. Marcos Alvarez of Morningstar DBRS told Reuters it hasn't been settled yet, noting that Lloyd's has generally required state-backed attack exclusions in cyber policies since 2023. If an attack gets attributed to a state, carriers may dispute or deny claims, he said — and how those exclusions hold up in a major, geopolitically charged loss is untested.

Supply chains and AI are the other pressure points. The Binance hack reportedly ran through a fake job interview and malware hidden in an ad, while last year's $1.4 billion Bybit heist leaned on a compromised third-party developer machine. Aon broker Kevin Kalinich told the FT that insurers can absorb a single $400 million or $500 million AI mistake, but not one replicated across a thousand companies at once — a systemic, correlated risk the industry is only starting to price.