Digital Asset Custody Crime Insurance

What this coverage does

Digital asset custody crime insurance responds when cryptocurrency, tokens, or other digital assets held in custody are stolen. Loss scenarios typically covered include compromise of private keys, unauthorized transfers from hot wallets connected to the internet, physical or logical breach of cold storage, and theft facilitated by a rogue employee or contractor with access to signing authority. Coverage is written on a first-party specie basis: the policy responds to the loss of the asset itself, valued in most cases at the digital asset's value at time of loss, subject to policy terms and sublimits.

This differs from a cyber liability policy, which is built around data breach response, third-party notification, and network security failures. A custody crime policy is closer in structure to a bankers blanket bond or financial institution crime bond, adapted for digital assets, and it typically sits alongside — not instead of — a separate cyber liability program.

Who needs it

Exchanges, qualified custodians, prime brokers, digital asset funds, trust companies, and corporate treasuries holding meaningful balances of digital assets on behalf of themselves or clients are the core buyers. Institutional counterparties and fund allocators increasingly ask for evidence of custody crime coverage as part of operational due diligence before allocating capital or opening a custody relationship, making the policy as much a counterparty-facing credential as a risk transfer tool.

What it covers and excludes in practice

Most policies split limits between hot wallet exposure (typically the larger perceived risk given internet connectivity) and cold or deep-cold storage, with underwriters scrutinizing multi-signature protocols, hardware security module usage, key sharding, and withdrawal approval workflows before binding. Insider collusion coverage generally requires that the loss result from a dishonest or fraudulent act intended to cause loss, and most forms exclude simple negligence, protocol-level smart contract failure, market value decline unrelated to theft, and losses arising from unsupported or unlisted blockchains. War, government seizure, and losses where the insured cannot produce sufficient forensic evidence of unauthorized transfer are also commonly excluded, subject to policy terms.

What drives price and how to structure it

Underwriters price primarily on total assets under custody, the hot/cold storage split, the sophistication of key management controls (multi-party computation, hardware security modules, geographic key distribution), personnel vetting and dual-control procedures, and prior loss or incident history. Programs are frequently layered and shared across multiple specialty and Lloyd's markets given aggregate capacity constraints for crypto risk, and self-insured retentions tend to run higher than in conventional commercial crime programs. Buyers can improve terms by documenting a formal key management policy, third-party security audits, and segregation of duties between transaction initiation and approval.