Crypto custody insurance sounds like a simple deal: pay a premium, and if someone drains the wallet, you get the money back. Reality is messier. If you run an exchanger and hold client funds across hot and cold wallets, the gap between "we're insured" and "this specific loss is covered" can decide whether the business survives the incident.
What crypto custody insurance actually covers
Most policies are crime insurance — protection against theft by outsiders or employees, not against a price crash or a buggy smart contract. The classic covered event: someone gets hold of the private keys to a hot wallet and moves the funds out.
These policies usually come from large insurance syndicates — Lloyd's of London is the name you'll hear most — placed through a broker rather than bought off the shelf. That's why underwriting is slow: before signing, insurers want an infrastructure audit, documented key-access procedures and your incident history.
What it almost never covers — and that's the real myth
The costliest misconception an exchanger owner can hold is assuming the policy covers the full client balance. In practice there's almost always an exclusions list, and it tends to exclude exactly the things most likely to happen.
- Smart contract bugs and protocol-level exploits — a different risk class, insured separately and rarely.
- Key loss from an employee's own negligence, as opposed to an external attack.
- Insider theft above a separate, usually much smaller sub-limit.
- Hot wallet balances above the policy's cap — and a busy exchanger can blow past that cap on an ordinary high-volume day.
Which creates an odd twist: the busier the exchanger, the more likely the hot wallet was over the insured cap exactly when the attack happened.
Why "insured" doesn't mean "fully insured"
Every policy carries an aggregate limit — the maximum the insurer pays across the whole policy period, not per incident. Two events in one year, and the second one may be only partially covered, or not covered at all, because the pool is already spent.
Inside a single policy there are usually internal sub-limits too: one figure for cold storage, a separate — and typically much lower — figure for hot wallets. The number that matters is buried in the schedule, not the headline.
What exchanger owners should check before trusting a policy or custodian
If custody sits with an outside provider, don't ask "are you insured" — ask what, exactly, and up to how much.
- Ask for the actual exclusions text, not the marketing one-pager — that's where the real picture lives.
- Compare the stated cap against your peak-day hot wallet volume, not the average.
- Check the claims process and payout timeline — a policy that pays out eighteen months later won't keep an operating business alive today.
- Find out whether multisig or hardware security modules are a condition of coverage — failing to meet that condition can void a claim on its own.
Common mistakes exchanger owners make
The most common one: never reading the exclusions schedule, trusting the word "insured" on a partner's slide deck. The second: keeping an oversized hot wallet balance "for convenience," forgetting that the hot wallet is usually the part insured the least.
The third mistake is treating insurance as a replacement for internal security rather than a backstop to it. A policy is the last line of defense — not the first, and definitely not the only one.
Conclusion
Crypto custody insurance is a useful tool, not a universal safety net. It works best alongside real operational discipline — separating hot and cold storage, multisig, hot wallet caps, regular audits. If you're building your own exchanger from the ground up, it's smarter to design that architecture in from day one rather than patch it in later — for instance with iEXWallet, where custody of client funds doesn't hinge on someone else's insurance fine print.
