What Custody Insurance Is For
An institution that places bitcoin with a third-party custodian accepts a specific risk: the custodian holds the keys, and if its security or operations fail, the institution can lose the asset. Custody insurance transfers part of that residual risk to an insurer. When a covered loss occurs, the insurer reimburses the custodian up to the policy limit, and the custodian is then able to make its clients whole.
The scope is narrow. Insurance covers the disappearance of the asset through a defined peril; it does not cover the asset performing badly. That distinction is the most common source of confusion among institutions evaluating a custodian. For the broader picture of how institutions hold bitcoin in the first place, see how businesses and institutions take custody of Bitcoin.
Why This Matters for Risk and Compliance Teams
For a risk or compliance function, an insurance certificate is a control rather than a guarantee. A policy reduces the financial impact of a custodian failure, subject to its terms, and treating its existence as evidence that funds are safe is a category error: the policy responds only after a loss, only for covered perils, and only up to a limit that is usually far below total balances. The job of the diligence team is to read the terms, measure the gap, and price the residual exposure that no policy covers.
What Custody Insurance Covers
A well-constructed custody insurance program responds to the ways a custodian can lose client bitcoin. These cluster into three groups.
Theft From Hot and Cold Storage
Theft is the headline peril. A custodian splits holdings between hot storage (keys on internet-connected systems for fast withdrawals) and cold storage (keys kept offline). Each carries different exposure. Hot-wallet keys face remote attackers and software compromise. Cold-storage key material faces physical theft and insider access. A custody program is typically layered so that one instrument responds to hot-wallet theft and another responds to cold-storage loss, because the two perils are underwritten differently.
Insider Theft and Employee Dishonesty
An insider with privileged access is one of the hardest threats for any custodian to defend against and one of the most important to insure. Crime cover responds to dishonest or fraudulent acts by employees, including collusion. Custody architecture and insurance reinforce each other here: controls that enforce separation of duties (no single employee can move funds alone) both reduce the chance of insider theft and make the residual risk insurable on better terms.
Physical Loss of Key Material
Cold storage concentrates value in physical key material held in vaults: hardware devices, paper records, or backups split with Shamir secret sharing. Physical loss or destruction of that material, through theft, fire, or disaster, can render bitcoin permanently unspendable even though the asset still exists on the network. Specie cover, the same class of policy used for vaulted bullion and fine art, responds to this peril.
What Custody Insurance Does Not Cover
The exclusions matter as much as the cover. Three categories sit firmly outside every standard custody policy.
| Excluded | Why it is not covered |
|---|---|
| Market loss | A fall in the price of bitcoin is not a loss of the asset. The bitcoin is still in custody and still spendable. Insurers underwrite the disappearance of property, not its valuation. Price risk is managed through treasury policy and hedging, not insurance. |
| The holder's own key mismanagement | If an institution self-custodies and loses its own keys, exposes its own recovery phrase, or authorizes a fraudulent transfer through its own staff, a custodian's policy does not respond, because the custodian never held the keys. Self-custody risk is the holder's own to manage. |
| Protocol and network risk | A loss caused by a flaw in the Bitcoin protocol, a consensus failure, or a smart-contract bug on another chain sits outside custody cover. Standard policies underwrite the custodian's operations, not the behavior of the underlying network. |
Other common exclusions and limitations include losses from acts of war, certain regulatory seizures, and any loss above the policy limit or below the deductible. The deductible (the first portion of any loss the custodian absorbs) is a routine feature and is often substantial for large programs.
FDIC and SIPC Do Not Cover Bitcoin
Custody insurance is private commercial cover arranged in the insurance market, rather than a government-backed deposit or investor-protection scheme. Federal deposit insurance from the FDIC applies to deposits at insured banks, and SIPC protection applies to cash and securities held at a failed broker-dealer, up to its statutory limits. Neither covers bitcoin. The FDIC states that deposit insurance does not extend to crypto assets and does not protect against the insolvency of a non-bank custodian, and SIPC does not protect a digital asset that is not a registered security. A balance described as "FDIC-insured" or "SIPC-protected" bitcoin is mislabeled, and the FDIC has warned firms against the claim. The cover that responds to a bitcoin custody loss is private commercial insurance, principally the crime and specie instruments described here, subject to its limits, sublimits, and exclusions.
Crime Bonds vs Specie Policies
Two distinct instruments do most of the work in a custody program, and they map to the two storage models.
A crime bond (also called commercial crime cover) responds to loss from dishonest, fraudulent, or criminal acts. It is the instrument most relevant to hot-wallet theft, external fraud, social-engineering attacks that trigger a fraudulent withdrawal, and employee dishonesty, including the insider with vault access. Crime cover follows the act rather than the location of the asset.
A specie policy covers physical loss of, or damage to, high-value tangible property held in a specified location such as a vault. It is the instrument most relevant to cold storage, where the loss looks like the theft or destruction of a physical object that holds the keys. Specie underwriters are accustomed to bullion, jewelry, and fine art, and they extend the same logic to vaulted key material.
Most institutional custodians carry both, layered into a single program so that whichever way a loss arises, an instrument responds. Reading a custodian's cover means understanding which instrument applies to which storage model and where the seams between them fall.
The Lloyd's of London Market
Much of the world's digital-asset custody insurance is underwritten in the specialist market at Lloyd's of London, where independent syndicates underwrite unusual and high-value risks. Lloyd's is a marketplace rather than a single insurer: a broker assembles capacity from multiple syndicates, each taking a share of the risk, which is how large limits are built for novel exposures that no single insurer would carry alone.
Two practical consequences follow for an institution. A large custody limit is usually syndicated across many underwriters, so the strength of the cover depends on the quality of that panel of underwriters rather than on a single counterparty. The specialist market also prices on the custodian's controls: a custodian with strong separation of duties, audited key ceremonies, and a clean operating history obtains broader cover at better rates. The diligence an institution applies to a custodian and the diligence the insurer applies are largely the same.
Coverage Limits, Sublimits, and the Gap Most People Miss
Limits and sublimits decide whether a custodian's insurance means anything to a given institution. The headline figure in a press release ("insured up to $X") is rarely the figure that protects a specific balance.
The Limit Is a Fixed Amount, Not a Percentage
A custody policy carries an aggregate limit stated in dollars. It does not scale with the amount of bitcoin under custody. A custodian holding several billion dollars of client bitcoin may carry a limit of a few hundred million. If that custodian suffers a total loss, the policy pays the limit and no more, and clients share the shortfall. The relevant question is the limit relative to total assets under custody, and how any shortfall would be shared among clients.
Sublimits Cap Individual Categories
Beneath the aggregate limit, sublimits cap what the policy pays for specific perils. A program might carry a high aggregate limit but a much smaller sublimit for hot-wallet theft, or for a single insider event. A loss can fall squarely inside a covered category and still exhaust its sublimit long before reaching the headline number. Reading sublimits is how an institution discovers what the cover actually protects.
The Gap Is the Real Exposure
The space between total assets under custody and the effective coverage available to a given client is the uninsured exposure. For most large custodians, most client balances sit inside that gap. An institution that understands this can size the risk: it knows that beyond the policy, its protection rests entirely on the custodian's security architecture and solvency. That understanding is what diligence is for.
Self-Insurance and Captive Structures
Commercial capacity for digital-asset custody is finite. Underwriters limit how much they will write, so a large custodian often cannot buy enough third-party cover to insure all client balances even if it wanted to. Some custodians close part of the gap with self-insurance: they set aside their own capital, sometimes through a captive (a wholly owned insurance subsidiary that underwrites the parent's risk), to fund losses the commercial market will not.
Self-insurance and captives can be legitimate parts of a risk program, but they change the diligence question. A self-insured layer is only as good as the custodian's balance sheet and the segregation of the reserve. If the custodian fails financially, a self-insured promise may rank alongside other creditors. For an institution, the distinction between commercial cover (a claim against an independent insurer) and self-insurance (a claim against the custodian itself) is material and should be confirmed in writing.
How to Read a Custodian's Insurance Claims
Marketing language about insurance is designed to reassure. The diligence checklist below converts that language into answerable questions. Each item is something an institution can request and verify before placing funds.
- What is the aggregate limit, and what is it relative to total assets under custody? A limit means little without the denominator.
- What are the sublimits per peril? Ask specifically for the hot-wallet, cold-storage, and single-insider-event sublimits.
- Which instruments make up the program? Confirm whether the cover is crime, specie, or both, and which perils each instrument addresses.
- How much is commercial cover and how much is self-insurance or captive? Treat these as different promises with different counterparties.
- Who are the underwriters? A syndicated Lloyd's panel of rated insurers is a different proposition from an unrated or single-line arrangement.
- What is the deductible, and who absorbs it? Confirm whether the client or the custodian bears the first loss.
- Are client assets segregated, and is the policy first-party or third-party? Determine whether a claim flows to clients or only to the custodian, and how recovery reaches a specific account.
- What are the named exclusions? Read the war, regulatory-seizure, and key-mismanagement exclusions in full.
A custodian that answers these readily is demonstrating the same operational maturity that earns it good cover in the first place. Reluctance to provide specifics is itself a diligence finding. These questions also pair naturally with verifying that the assets exist at all, which is the role of proof of reserves, and with confirming the custodian's regulatory standing, the subject of what a qualified custodian is.
Why Insurance Is Not a Substitute for Sound Custody Architecture
Insurance and architecture solve different problems. Architecture lowers the probability and size of a loss before it happens, while insurance transfers a capped portion of whatever residual loss remains. An institution that leans on insurance to compensate for weak architecture has the order backwards: a policy with a limit far below balances and a long list of exclusions cannot make up for keys that one person can move alone, or for storage that has never been audited.
Good architecture reduces what insurance has to do, and good insurance prices the architecture it sits on top of. The strongest custody programs invest first in the controls that prevent loss (separation of duties, audited key ceremonies, hardware isolation, on-chain verifiable reserves) and then buy insurance for the residue.
Self-Custody Removes the Custodian as a Single Point of Failure
There is a structural alternative to insuring a custodian's failure modes: remove the custodian. Self-custody with multisig governance distributes signing authority across several independent keys held in separate places, often by different people or entities. No single key can move funds, so no single compromised employee, device, or location causes a loss. The attack class that custody insurance exists to cover (a third party holding all the keys and failing) is removed by design rather than transferred to an insurer.
Removing the custodian is a real reduction in risk, and it should be stated precisely rather than overclaimed. Multisig self-custody removes the custodian as a single point of failure, but it does not remove every risk. An institution self-custodying with multisig still has to defend the things that remain:
- Key generation and storage. Each key must be generated securely and stored so that it cannot be lost or quietly copied. A hardware wallet such as Jade Plus keeps a key isolated from internet-connected systems.
- Recovery-phrase exposure. A leaked or photographed recovery phrase can defeat the protection a key was meant to provide. Backup procedures need the same rigor as the keys themselves.
- Quorum and signer compromise. If an attacker can compromise enough signers to reach the threshold, the multisig is defeated. The threshold, the independence of signers, and their physical separation all matter.
- Operational error and coercion. Authorizing a transfer to the wrong address, or under duress, is a loss no signature scheme prevents. Procedure, verification steps, and policy controls defend this surface.
- Inheritance and continuity. A multisig that no surviving person can reconstitute is a different kind of total loss. Continuity planning is part of the architecture.
The choice between an insured custodian and self-custody with multisig is an allocation of risk. An insured custodian transfers a capped portion of an outsourced risk and adds counterparty and limit risk on top, while self-custody with multisig removes the counterparty entirely and replaces it with the institution's own operational discipline. Each path leaves a defined set of risks to defend, and the institution's job is to know exactly which set it has chosen.
This article is educational and does not constitute legal, insurance, or investment advice. Insurance terms, limits, and exclusions vary by policy and provider; confirm specifics with the custodian and insurer before relying on any cover.
Frequently Asked Questions
Does Bitcoin custody insurance cover a drop in price?
No. Custody insurance covers loss of the asset itself through theft, insider crime, or physical destruction of key material. It never covers a decline in market value. If bitcoin falls in price while it sits safely in custody, no insurer pays out, because nothing was lost in the terms the policy defines. Price risk is managed through treasury policy, not insurance.
What is the difference between a crime bond and a specie policy?
A crime bond covers loss from dishonest or fraudulent acts, including employee theft and external fraud, and typically responds to hot-wallet and operational exposure. A specie policy covers physical loss or damage to high-value property held in a vault, which maps to cold storage key material. Many custodians carry both, layered to cover different failure modes.
How much of a custodian's assets under custody is actually insured?
Usually a small fraction. Coverage limits are stated as a fixed dollar amount, not a percentage of total assets under custody, and sublimits cap individual loss categories below the headline figure. A custodian holding billions may carry a few hundred million in cover, so most balances exceed the policy limit. Ask for the limit, the sublimits, and the ratio to total assets under custody.
Is insurance a substitute for good custody architecture?
No. Insurance pays after a custodian fails, subject to limits, deductibles, and exclusions. It does not prevent loss. Sound custody architecture reduces the chance and size of a loss in the first place. Insurance and architecture address different problems: one transfers residual risk, the other lowers the risk being transferred.
Does self-custody need insurance?
Self-custody removes the custodian as a single point of failure, so there is no custodian whose default an insurer would cover. Multisig spreads signing authority across independent keys and locations, which removes several attack classes. It does not remove every risk: key loss, recovery-phrase exposure, coercion, and operational mistakes still need procedural and physical defenses.