If you hold a large amount in crypto, the question of insurance comes up. What's actually covered when an exchange gets hacked, whether a DeFi smart contract exploit is recoverable or whether you can buy a policy against your own mistake. The answers are less reassuring than the marketing makes them sound. Crypto insurance exists, but it covers narrower scenarios than most holders assume, and the policies that would cover the most common failure modes don't really exist at retail scale. This piece walks through the three categories of crypto insurance that exist in 2026, what each one actually covers, and why structural redundancy on a hardware wallet ends up being the only insurance most retail holders can rely on.

The three categories of crypto insurance

When people say "crypto insurance," they usually mean one of three different things. Exchange custody insurance: Major exchanges hold crime insurance policies that cover specific loss events from their hot wallets. Coinbase, Gemini, Kraken, and Binance each have one. The policies are typically arranged through Lloyd's of London or similar underwriters and cover scenarios like external hacking of the hot wallet, employee theft, or specific physical damage to custody infrastructure. For example, Coinbase has publicly disclosed a \$255 million crypto insurance policy covering a portion of customer assets held in its hot wallets. DeFi protocol insurance: A small group of decentralized insurance protocols offer coverage against specific smart-contract exploit events for major DeFi protocols. Nexus Mutual is the largest, with Sherlock, Unslashed, and InsurAce as smaller players. Policies cover named events on named contracts, usually with a payout cap and a time-limited window. Individual retail policies: Several traditional insurers and specialty firms offer policies for individual crypto holders. These are niche, expensive, and underwritten with significant restrictions. They exist but they're rare enough that most retail holders never see one.

What each one covers

The coverage is narrower than the category names suggest. Exchange custody insurance covers losses from hot wallet hacks and certain physical or employee theft events at the exchange's own infrastructure. It does NOT cover the exchange's bankruptcy, your own account credentials being phished, your wallet being SIM-swapped, or the exchange pausing withdrawals during a market panic. The Mt. Gox creditors, the FTX creditors, the Celsius creditors all owned crypto on platforms that had some form of insurance. None of them got recoveries through those insurance policies; they got recoveries (where they got them at all) through bankruptcy proceedings. DeFi protocol insurance covers smart-contract exploit events on named protocols. To collect, you need to have bought a policy before the exploit, the exploit needs to fit the policy's definition of a covered event, and you need to file a claim within the policy window. Nexus Mutual has paid out on several major incidents (the Yearn vault hack, the Anchor protocol issue during Terra, others). It hasn't paid out on others where the exploit didn't match the policy definition. The system works for what it's designed to cover. It doesn't cover phishing, address-substitution attacks, or wallet drainers. Individual retail policies cover physical loss of the hardware wallet (some), theft of the wallet under specified conditions (some), and certain narrow scenarios involving fraudulent transactions. They typically don't cover phishing, social engineering, or user error. Premiums are high relative to the coverage cap, and underwriting often requires the holder to follow specific operational practices.

What none of them cover

The failure modes that account for most retail crypto losses are not insurable in practice. Phishing and approval scams are the largest category of retail loss in DeFi. Insurance doesn't cover them because the user authorized the transaction. The signature was valid. From a policy standpoint, it's the same as the user deciding to send their funds away. Address-substitution attacks aren't covered for the same reason. Malware swapped the address in the user's clipboard; the user signed the transaction. Insurance treats this as a user-authorized send. Lost seed phrases are not insurable because there's no mechanism to prove the loss to the insurer. The crypto might be sitting on-chain right now waiting for the seed phrase to be reconstructed. Insurance can't underwrite that. Exchange bankruptcy is the big one. The insurance covering an exchange's hot wallet doesn't cover the exchange itself becoming insolvent. Customer balances become unsecured claims in bankruptcy proceedings, with recovery determined by what assets the estate can locate and distribute.

Why self-custody removes most of these problems

The structural failure modes insurance can't cover at retail scale are the ones a hardware wallet doesn't have in the first place. A wallet that lives on your own hardware wallet can't be hacked by an exchange's compromised employee, because the exchange doesn't have your wallet keys. It can't be frozen by an exchange's withdrawal pause, because there's no exchange in the path. It can't be lost in an exchange bankruptcy, because it's not on the exchange's books. The failure modes a hardware wallet still has (phishing, address substitution, key loss) are the same ones the insurance industry can't underwrite at retail scale. Removing the exchange dependency removes the larger class of losses. The remaining ones are the ones every holder still has to design around.

The insurance retail holders need

There unfortunately isn't an insurance company that can insure your self-custody. You're really only as secure as your self-custody practices. The biggest residual risk for a self-custody holder is losing access to your own wallet: a fire that destroys the device and the seed phrase paper next to it and you don't create a new backup, a move where the safe gets cleared without your knowledge, a death where the heirs don't know where the keys are. Traditional insurance can't help with any of those...but backup design can. Ryder One ships with TapSafe Recovery as the structural answer to this class of risk. The wallet backup is split: 50% lives on the Recovery Tag (battery-free, NFC, IP69K rated), 50% lives encrypted in your phone's iCloud or Google Drive backup (not on the phone itself), with optional 25% per Recovery Contact for the people you trust. No single component on its own gives anyone access. No single failure (fire, theft, lost phone) takes the wallet down. The seed phrase remains available on-device as a last resort. The firmware that runs this is independently audited by Halborn, with the audit report public. This isn't insurance in the legal sense. There's no premium, no policy document, no claims process. What it is, structurally, is the same coverage insurance is supposed to provide: protection against the catastrophic failure mode you most realistically face, with a payout structure (your funds, recovered) that doesn't depend on filing a claim or proving anything to an underwriter.

When formal insurance still matters

There are cases where formal crypto insurance is worth carrying. Most of them aren't retail. - Corporate treasuries that need disclosed coverage to satisfy shareholders - DeFi power users with large positions in specific protocols they're willing to pay for insurance on - Institutional custodians who insure their hot wallets as part of regulatory and audit requirements For retail self-custody, the realistic conclusion is that insurance covers a small slice of the things that could go wrong, doesn't cover most of the failure modes you actually face, and isn't a substitute for a backup model that addresses the things insurance can't.

The bottom line

Crypto insurance exists but covers less than the marketing implies. Exchange policies cover the exchange's hot wallet, not the exchange's bankruptcy. DeFi insurance covers named smart-contract events, not phishing or user error. Individual retail policies are rare and expensive. The largest category of retail losses (phishing, address-substitution, key loss) isn't insurable at any practical price. What replaces insurance for self-custody holders is structural redundancy in the backup. Distribute the recovery material so no single failure can take everything down. That's the actual insurance for the failure modes real holders face.

Get the coverage insurance can't sell you. Ryder One ships with TapSafe Recovery as built-in structural backup, splitting your wallet recovery across hardware and people you choose. See how it works.