Crypto’s insurance test starts with custody

Crypto wants the confidence of mainstream finance. Protecting other people’s assets is where it has to earn it.

The reported Binance theft raises a question that should concern every institution holding substantial customer funds: how much can an attacker take before somebody can stop them?

Binance’s investigation is continuing. Its account has developed beyond the initial report of a compromised laptop to describe a more complex attack involving additional points of breach. We should wait for the findings before diagnosing the failures. But a complex attack still demands an explanation of how the safeguards around moving assets were overcome.

Comparisons with traditional banking are useful here. Independent approvals, transaction limits and separation of duties can seem cumbersome. They exist because financial institutions have to assume that someone will eventually get inside.

Some of the friction we complain about in banking is protecting our money.

For insurers, the issue is whether those safeguards impose a credible limit on loss. Several approvals offer little comfort if the same compromised process can deceive every approver. Keeping a private key secret may achieve little if an attacker can cause the system holding it to authorise fraudulent transactions. That distinction also matters to coverage.

The stolen assets point first towards digital asset custody or crime insurance, including specialist specie cover.

Calling this a cyber attack does not make the missing cryptocurrency a conventional cyber insurance claim. Whether specie responds depends on what was insured and how. Cover for assets secured through specified offline custody arrangements should not be assumed to extend to an operational hot wallet or a compromised withdrawal process. Broader theft cover may present a different analysis.

Binance’s statement that it has found no evidence of private-key leakage is therefore relevant, but not conclusive. A policy may cover theft of the assets without requiring the attacker to extract the keys. Another may define its protection much more narrowly.

“The keys were not stolen” is not the same as “the assets were not insured”. Nor does it establish that they were.

The wording has to be tested against the actual transaction mechanism, custody arrangements, conditions and exclusions. Without Binance’s policies and the completed investigation, a firm conclusion about insurance recovery would be premature.

Business interruption presents a separate question. A deliberate suspension to contain an attack can fall within cyber BI cover where the wording provides for it. Describing the decision as “voluntary” does not resolve the claim. The relevant questions include whether a covered security event triggered the suspension, whether shutdown or containment measures fall within cover, and whether any consent requirements were met.

We also need to be precise about what stopped. Suspending withdrawals is not necessarily taking systems offline. If trading continued, the effect on fee income could be very different from a complete exchange outage. The insured must still establish a covered interruption and resulting loss, subject to the waiting period and other policy terms.

The headline theft figure consequently tells us little about the eventual insurance bill. Assets frozen are not necessarily assets recovered. A commitment to reimburse customers does not establish that an external insurer will fund it. Binance’s SAFU reserve and its own balance sheet must be distinguished from insurance purchased in the market.

The lesson for underwriters is to examine how custody and transaction controls perform together under attack. For brokers and buyers, it is to test whether cover follows the ways assets can actually be stolen, including misuse of a legitimate signing process.

Crypto’s ambition is to become mainstream finance. Its controls, and the insurance protecting them, need to withstand mainstream scrutiny.