Insurance for crypto: A 'hot' and 'cold' affair
The key to insurance for cryptocurrency operations comes down to the difference between hot and cold – and not just in the sense that some coins are on the way up and others down. In the security context, “hot” and “cold” refer to types of wallets for crypto, with hot wallets being most vulnerable, and cold wallets being the safest.
The biggest and most widely used cryptocurrency exchanges – such as Binance, Coinbase, Kraken and Gemini – keep just enough cryptocurrency in a readily accessible hot wallet to meet trading demand. Hot wallets live on the internet, making them more vulnerable to hacking or theft. A cold wallet for cryptocurrency has taken the asset and printed a record of it for physical storage. It is offline, not connected to the internet, and contains the asset holder’s address and private crypto key for their holdings.
Hot wallets or warm wallets, which are simply hot wallets that let their users download their holdings, are much tougher to insure than cold wallets, according to William Dyer, vice president of insurance services at HCP National Insurance Services. Cold wallets are no different to insure than any other physical asset such as a car or a house. The market for insuring hot wallets costs more for less coverage than most other assets – and even more than insurance against any real-world physical criminal theft or damage, Dyer explains.
“Normal crime insurance costs 1% of the [coverage] limit,” he says. “For hot wallets, it can go up to 10%, even 20%. If you have a $1 million limit, it could cost $100,000 or $200,000 a year.”
“Many insurers will give you a policy, but the policy doesn’t cover much,” Dyer adds. “There are some exceptions, but many who have a cryptocurrency policy don’t realize that it’s not really covering a whole lot.”
Still, some insurers are working to develop an underwriting framework for cryptocurrency, according to Jacqueline Quintal, digital asset leader at Marsh.
“We’re doing a lot of work, both with specific clients and also with insurers on a broader non-client specific basis, to say, ‘here are the types of things we’re seeing,’” says Quintal. “Here’s the opportunity for you from an insurer perspective and to build a framework for increasing the size of that market, because certainly client demand has outpaced capacity.”
As it stands, the market for cryptocurrency insurance coverage stands at about $200 million, according to Dyer, but he projects that could reach $1 billion within two years as more large insurers enter the business.
Quintal adds, “It certainly is rapidly increasing and would be increasing faster than it is, were there more insurance capacity than exists. Growth right now is constrained by market capacity rather than by interest or willingness to pay on the part of prospective insurance. A lot of companies in this space would buy more if they could, and if it were more favorably priced.”
Gemini, for instance, does have insurance for its hot wallets that covers direct security breaches or hacks, or theft by Gemini employees. However, theft of digital assets by third parties, hacks of third-party systems or user-initiated fraudulent transactions are not covered.
Yusuf Hussain, head of risk at Gemini, has written that insurers are reluctant to cover cryptocurrency operations because of high-profile hacks that caused catastrophic losses, along with poor security policies and systems. Gemini secures users’ hot wallets in offline cold wallets that are subject to FDIC pass-through deposit insurance.
Some insurers, HCP’s Dyer says, will use a version of errors and omissions policy coverage for cryptocurrency operations, but with significant exclusions. As with cybersecurity insurance, reinsurers like Lloyd’s of London are better able to take on such great risk, he notes.
