Crypto insurance: whose policy covers which loss?

An exchange's insurance announcement is the beginning of a coverage question. To understand it, identify the insured business, the loss covered and the route through which a customer could benefit. A large advertised limit does not establish a personal entitlement to that amount.

Commercial policies and statutory protection schemes also serve different purposes. This article uses provider disclosures and official US FDIC and SIPC explanations checked on 23 September 2026. The examples illustrate document-reading questions; they do not determine coverage for a claim or recommend an insurer.

Start with the insured and the loss

Coinbase's insurance overview says Coinbase, Inc. and other operating subsidiaries are covered by Coinbase Global's crime insurance. It describes protection for a portion of digital assets against theft, including cybersecurity breaches. It excludes losses from unauthorized access to a personal account caused by compromised or lost credentials and warns that losses can exceed insurance recoveries.

That disclosure identifies both a corporate insurance arrangement and a boundary around the covered event. It does not say that every customer holds an individual policy. When reading another provider's announcement, look for the named insured, any customer beneficiary or loss-payee provisions, who submits the claim and who receives payment. If the announcement omits those points, do not substitute assumptions about direct customer rights.

Separate three documents: the insurance contract, the custody agreement and any customer reimbursement promise. They answer different questions about the insurer's obligation, the custodian's obligation and the communication made to the customer. Our guide to custody segregation and customer assets explains the custody side of that reading exercise.

The covered cause matters as much as the missing asset

An asset can be missing after very different events. An outside attack on institutional key storage, compromise of a customer's login, failure of a lending platform and a fall in market price should not be treated as interchangeable insurance triggers.

For example, Evertas's FAQ describes custody policies for theft or loss of private keys held by institutional asset holders. It says Evertas does not offer policies against insolvency of staking or lending platforms or against large price movements. Those statements describe that provider's offering; they do not establish exclusions in all crypto-related policies.

The same FAQ says policies are issued through licensed brokers after underwriting. A logo, screenshot or counterpart's assurance therefore needs more evidence than the word insured. Evertas's legal notice directs readers to the actual policy for the governing coverage, conditions and exclusions.

Read the layers of the limit

Use the following as a worksheet, with the policy's own definitions beside each entry.

These distinctions are visible in actual insurance wording. As a general policy-structure example, Chubb's Czech-jurisdiction Cyber ERM wording, sections 5.4–5.5, places sublimits within aggregate limits and describes an uninsured excess. This is a cyber-policy example, not evidence that a particular custodian has crypto theft cover from Chubb.

Consequently, dividing an advertised corporate limit by customer count is not a reliable coverage calculation. It leaves out the trigger, applicable sublimit, existing claims, valuation terms and customer payment rights. The worksheet records the variables that a headline number leaves unresolved.

FDIC and SIPC require different questions

For the United States, the FDIC's official explanation distinguishes insured deposit accounts from investments, including crypto assets, which it does not insure. A provider's banking relationship cannot turn a crypto token into an insured deposit.

SIPC's explanation concerns missing eligible securities and associated cash when a member brokerage fails; it does not protect market losses. Digital assets must meet SIPA's definition of a security, and unregistered investment contracts are excluded even at a member firm. These are US rules, not worldwide protection standards.

The useful finished record is a sentence with all its conditions: this entity is insured, for this type of loss, within these limits, with this path to customer recovery. Any blank remains a question. As with regulatory approval and product guarantees, the named protection needs to be matched to the precise promise being made.