No insurance policy on the market covers a loss the size of the Binance theft. That is the plainest finding in Reuters’ Friday report on how insurers are responding, and it is the right starting point for a question many users are asking: if an exchange loses billions, who pays? Binance says it will bear the full cost of the roughly $6.3 billion taken on October 29, funded from its own treasury, its SAFU emergency fund and part of its futures insurance fund. The insurance industry’s role looks much smaller.

This piece does not retell the attack, which we covered when the FBI attributed it to North Korea. It looks at what insurers and brokers are saying, why crypto cover tops out where it does, what Binance has disclosed about how its signing systems were breached, and what controls underwriters ask exchanges about. One caution up front: the idea that exchanges will now have to prove more than their reserves is an inference. No insurer or regulator we read says so.

What insurers and brokers are saying

Reuters quotes brokers and lawyers, not the insurers that would pay. Gallagher’s David Rogers said the first question at new business and renewals will probably be about a client’s exposure to Binance and funds held there. Marsh’s Jacqueline Quintal expects more questions but no material change to capacity, pricing or coverage. Reed Smith’s Peter Hardy said any specific flaw found at Binance could become a requirement for others to fix, and Herrick’s Alan Lyons expects tighter wordings, clearer exclusions and a review of aggregate exposure and sub-limits. Effects are expected mainly at the next renewal, and the report gives no premium figures. A story that insurers are raising prices is not supported by what we read. Morningstar DBRS analyst Marcos Alvarez said insurers are not expected to retreat broadly from crypto.

Why cover stops short of a loss this size

The most recent figure we found for the largest single policy is $420 million, which Evertas, a Lloyd’s coverholder, said in 2023 it could write for a custodian or exchange, and the firm estimated then that only 2 to 3 percent of crypto assets were insured. That is three years old, and we found no current limit. Market forecasts quoted by Reuters vary widely, such as $9.4 billion in 2025 rising to about $185 billion by 2033 from one vendor and $13.8 billion in 2026 from another, and they are projections, not premium data.

An unnamed person told Bloomberg Law that Binance has directors-and-officers cover but, like other crypto firms, has been unable to get cyber insurance, and that any policy would likely cover a fraction of the loss. Binance has not said publicly what insurance it holds. Specialists quoted by Bloomberg Law add that standard cover may not respond to this kind of loss at all: Brown & Brown’s Christopher Keegan said specie cover typically would not respond to a hot-wallet hack, and a Lathrop GPM lawyer said state sponsorship does not automatically void cover but can turn on how attackers got in and how assets were stored.

That last point reflects a clause. Lloyd’s cyber policies have generally had to carry state-backed or war exclusions since 2023, and Insurance Business cites a Lloyd’s market bulletin requiring them in standalone cyber policies from March 31, 2023. If an attack is attributed to a state, insurers may dispute or deny claims. How those exclusions would hold up in a loss like this is untested, and the FBI’s attribution to North Korea puts that question in play.

SAFU, Binance’s own cushion

The SAFU fund, created in 2018, showed about $1 billion in bitcoin on Binance’s site, according to Reuters. Cointelegraph reported that the public SAFU wallet fell from about 15,000 bitcoin to about 7,500, around $583 million, by November 2 after a 7,499 bitcoin transfer Binance linked to partial use of the fund. Binance’s stated policy is to rebalance to $1 billion if the value falls below $800 million, with no timeline given after a hack. Binance’s own post says it set aside more than 100 percent of affected funds and that 98 percent of affected token assets had been replenished as of October 31, though Cointelegraph and Bloomberg Law report 90 percent and then 95 percent, and we could not reconcile the figures. Binance also published a snapshot showing 10 assets backed at least 1 to 1.

What Binance says went wrong in its signing systems

Binance’s own preliminary post says attackers gained unauthorized access to an internal wallet signing service and started transactions that bypassed normal withdrawal procedures. It says they abused EIP-7702 delegations, a feature that lets a wallet temporarily run smart-contract code, set up with 50 signed transactions. The affected hot wallets used multi-party computation, a technique that splits a key across systems, and Binance says no single private key could immediately revoke the delegations, so it needed a special on-chain procedure. It reports no private-key theft, and it says it rebuilt the wallet system, replaced devices, revoked credentials and will seek an independent review. This is Binance’s account and has not been independently verified. TRM Labs says ordinary signed transfers on nine other chains point to compromised signing infrastructure and that Binance had not confirmed that at the time; Blockaid’s Ido Ben-Natan leaned toward misuse of keys rather than leakage.

A secondary summary of Binance’s November 3 post-mortem, on HackerNoon, lists a deployment-capable token on an engineer’s laptop, endpoint tools that missed the malware, an internal AI tool used for lateral movement, and no fast way to cancel on-chain delegations. Reuters reported on November 3 that the attackers used a fake job interview and a tampered tool. Those details come from second-hand accounts, so treat them as reported.

What underwriters ask for

Insurance Business says underwriters are likely to ask about the share of funds in hot wallets, privileged-access controls, endpoint security for engineers, and evidence that any self-insurance fund holds what it claims, and it states that no regulator or insurer has set a formal requirement. A crypto insurer’s own guidance, from Relm in October 2025 and not specific to exchanges, says underwriters ask about the online versus offline share of assets, may impose separate hot and cold sub-limits, and may lower premiums for multisignature or MPC custody, hardware security modules validated to a U.S. federal standard, multifactor authentication, least-privilege access, penetration tests, SOC 2 reports and incident-response plans. Relm sets no thresholds.

A custody vendor, Fystack, which sells related products, argues that multi-party computation protects keys but not what gets signed, and urges rules on the signing side such as outflow caps and blocking delegation payloads. That is a vendor view. We found no insurer or auditor source on whether proof of reserves or proof of controls is the better test in this case.

The rules that already apply

The regulatory pieces predate the theft. MiCA Article 75 requires custody policies that reduce the loss of assets or means of access through fraud, cyber threats or negligence, and makes providers liable for losses up to the market value at the time of loss, except where an incident is independent of the service. ESMA’s review of crypto-asset service providers’ operational resilience, announced in September, prioritizes custody, key management and incident response and runs from the second half of 2026 to the first half of 2027. The SEC’s October 1 proposal on crypto custody by advisers and funds takes comments until December 7, and its page does not show exchange coverage. New York’s 2023 custody guidance covers segregation and insolvency protection, not key security. After the hack, the only new idea we found is CFTC Chair Michael Selig’s suggestion of a “federal option” for offshore exchanges to register under U.S. cybersecurity standards, with no rule text.

How Bybit compares

Bybit’s roughly $1.46 billion loss in February 2025 came from a multisignature cold wallet whose signers saw a manipulated interface, according to Insurance Journal, and Bybit used bridge loans to keep balances 1 to 1. By August 2026 about 5.3 percent of the stolen funds had been recovered or frozen, and we found no insurance payout for Bybit in any source.

What we could not confirm

We could not find a sourced comment from Aon, Beazley, Coincover, Arch or any Lloyd’s syndicate, and we do not know whether any insurer has changed pricing, capacity or wording. Binance’s actual insurance program and any claims are unknown beyond one anonymous source. We found no current maximum policy limit, no full Binance root-cause report or independent review, and no regulator proposal to set key-management or signing standards after the hack. Several pages were read through summaries, so check exact wording before quoting.

Why it matters

The lesson for users is that an exchange’s balance sheet and its own funds are the real backstop, not an insurance policy. For exchanges, the useful questions are the ones underwriters already ask: how much sits in hot wallets, who can approve a transaction, and what stops a compromised signer from emptying an account. Those answers will matter more at the next renewals, and if regulators write standards, they will likely draw on the same controls. This is reporting, not legal or financial advice.

Further reading

Frequently asked

Is the Binance hack covered by insurance?

Reuters reports that no available policy covers a loss of this size. An anonymous source told Bloomberg Law that Binance has directors-and-officers cover but has been unable to get cyber insurance. Binance says it will bear the full cost from its own treasury, its SAFU fund and part of its futures insurance fund.

Will crypto insurance prices rise after the hack?

Not according to the sources we read. Marsh expects more questions but no material change to capacity, pricing or coverage, and Reuters gives no premium figures. Effects are expected mainly at renewals.

What is the SAFU fund?

Binance’s emergency fund, created in 2018, which held about $1 billion in bitcoin before the hack. Cointelegraph reported the public wallet fell from about 15,000 bitcoin to about 7,500 by November 2. Binance says it rebalances to $1 billion if the value falls below $800 million.

What do insurers ask crypto exchanges about security?

Reports and insurer guidance point to the share of funds in hot wallets, privileged-access controls, endpoint security for engineers, key management such as multisignature or MPC, multifactor authentication, penetration tests and incident-response plans. No insurer or regulator has set a formal requirement, according to Insurance Business.

How did the attackers get in, according to Binance?

Binance says attackers gained unauthorized access to an internal wallet signing service and abused EIP-7702 delegations, and that no private keys were stolen. This is Binance’s preliminary account and has not been independently verified.