Bitcoin custody insurance is cover that pays out if Bitcoin held in custody is lost through specified events, typically theft or destruction of private keys. It rarely covers everything a board might assume. Market falls, custodian insolvency and losses caused by the company's own staff are commonly outside the policy, and the headline limit may be shared across every client of the provider.
For a CFO, the useful question is not "is it insured?" but "which losses, up to what amount, for whom, and under what conditions?"
Why Bitcoin custody insurance needs careful reading
Insurance for digital assets is still a specialist market. Capacity is limited, terms vary widely and policies are written around particular custody designs. A provider may describe itself as "insured" when the cover applies only to a fraction of assets or only to certain storage types.
This is why insurance should be one item in a structured custodian due diligence process rather than a selling point taken at face value.
Common types of cover
| Policy type | What it is designed for | Typical holder |
|---|---|---|
| Specie or vault-style cover | Physical theft or destruction of key material held offline | Custodian, for its cold storage |
| Crime or fidelity cover | Theft by employees or external fraud against the provider | Custodian or the company itself |
| Cyber cover | Costs of a cyber incident; often excludes the stolen digital assets | Company or provider |
| Professional indemnity | Claims from negligent service | Custodian or adviser |
| Directors and officers cover | Claims against directors over decisions | Company |
Policy names and structures vary by market. The table is a guide to the categories, not a description of any particular policy.
What is usually covered
Depending on the policy, cover may respond to:
- Theft of private keys or key shares by outside attackers.
- Theft or collusion by the custodian's own employees.
- Physical damage or destruction of offline key material.
- Certain losses arising from the custodian's operational error.
What is usually not covered
Common exclusions and gaps include:
- Market value falls. Insurance does not protect against price movements.
- Custodian insolvency. If the provider fails without a theft, a theft policy does not respond. Protection there depends on the legal structure; see bankruptcy remoteness.
- Losses caused by the client. If the company's own staff approve a transfer to a fraudulent address, the custodian's policy usually will not pay.
- Online or warm wallets. Cover may be lower, or absent, for keys used for frequent signing.
- Breaches of policy conditions. If required procedures were not followed, the insurer may decline the claim.
- War, sanctions and certain state actions.
Shared limits and who can claim
Two structural points are often missed.
The limit is often aggregate
A custodian's policy limit is usually shared across all its clients. If a single incident affected many clients, each might recover only a part of their loss. Ask how the limit compares with total assets under custody, and how a payout would be allocated.
The company may not be the insured party
Many custody policies insure the custodian, not its clients. The company may have no direct right to claim and would rely on the custodian to pursue the insurer and pass on any recovery. Ask whether the company can be named as a loss payee or additional insured, and take legal advice on what that changes.
Practical tip: ask for a broker's letter or summary of terms, not a marketing statement. Then have your own insurance broker read it. A short review now is far cheaper than discovering a gap after a loss.
Insurance for self-custody and shared control
Companies that hold their own keys, or one key in a multisig arrangement, face a harder market. Cover may be available but often comes with strict conditions about storage, signing procedures and key holder vetting.
Points to check:
- Does the company's existing crime policy cover digital assets at all? Many standard wordings do not.
- Would a loss at an independent key agent be covered by its policy, the company's, or neither?
- Do the insurer's conditions match the company's key management and signing policy? If not, one must change.
How insurance fits the governance picture
Boards should see insurance as the last line of defence. The order of protection is roughly:
- Strong signing controls and dual control to prevent losses.
- Segregation and a sound legal structure, so assets remain the company's if a provider fails.
- Independent assurance, such as SOC 1 Type II and SOC 2 Type II reports, showing controls work over time.
- Insurance, to recover some losses that get through.
Insurance cannot make up for weakness in the first three. It also does not change the accounting: under fair value rules, the holding is measured at market value whether or not it is insured. Companies should take their own accounting, tax and legal advice.
Questions to ask about any custody insurance
- Who is the insured party, and can the company claim directly?
- Which events are covered, and which are excluded?
- What is the limit per event and in aggregate? Is it shared across clients?
- Does cover differ between offline and online storage?
- What conditions must be met for a claim to succeed?
- When does the policy renew, and how will the company be told of changes?
Review the answers at least annually, and whenever the holding grows materially.
How The Bitcoin World helps
We help finance teams read custody insurance terms in the context of the wider custody design and legal structure, and summarise the findings for the board within our custody architecture work. We do not hold client assets and do not sell insurance. Custody and execution are carried out by licensed third-party institutions.