Binance $6.3 billion heist to prompt closer scrutiny by insurers

By Noor Zainab Hussain and Manya Saini

Nov 6 (Reuters) - Last week's $6.3 billion Binance heist is prompting insurers to scrutinize crypto companies' security more closely, with underwriters expected to probe if clients are vulnerable to a similar attack when they seek new coverage or renew existing policies, industry insiders and experts said.

Insurers are not expected to broadly retreat from the crypto sector or reduce the availability of coverage. But the largest crypto theft on record could bring tougher scrutiny of crypto firms' exposure to Binance and any weaknesses identified in the attack, which the FBI has blamed on a North Korea-linked group.

The attack underscores the limits of the insurance coverage available for the fast-growing over $2.5 trillion industry. No available crypto insurance could cover a loss of the scale suffered by Binance, experts said, while many policies have exclusions for state-backed cyberattacks.

Grand View Research projects the global crypto insurance market will grow to $192.7 billion by 2033 from $13.8 billion in 2026.

"Insurers will be asking questions specific to Binance. Their first question will be very simple: what is your exposure to them and do you have any money with them?" said David Rogers, managing director of financial institutions at Gallagher.

As more details emerge on what went wrong, the questions may get more specific, potentially reshaping underwriting behavior, he said.

TOUGHER QUESTIONS AT RENEWAL

According to a report that Binance published this week, hackers used a bogus job interview and software hidden in an ​advertisement to compromise the computers of two Binance software engineers before using a third computer to drain $6.3 billion worth of crypto.

The world's largest crypto exchange detailed a multi-stage hacking endeavor that began in June and set off a series of security breaches culminating in the theft on Thursday.

Following the attack, crypto exchanges quickly moved to bolster their defenses and push for greater information-sharing across the industry, Reuters has reported.

The implications of their insurance will likely become clear at their next renewal, executives said. Policies typically run for a year, giving underwriters an opportunity to reassess a client's risks, seek updated information and impose new security requirements before agreeing to extend coverage.

Jacqueline Quintal, Marsh's financial institutions and digital asset industry leader, said she did not anticipate material changes in insurance capacity, pricing or coverage, but for insurers to ask clients more questions, including whether they could be exposed to a similar attack.

She said one would not want to be the person who, a week after this happened, renews or writes a crypto risk and then the same thing happens.

The scrutiny could extend beyond a general assessment of whether cybersecurity controls to specific weaknesses uncovered by the Binance investigation. Insurers may seek assurances that similar vulnerabilities do not exist elsewhere during renewal.

"If it becomes apparent from the investigation into this hack that there was a very specific weakness or flaw in Binance's security, then other insurers can certainly expect to see a requirement for that weakness or flaw to be resolved," said Peter Hardy, a London-based insurance lawyer at Reed Smith.

INSURANCE HAS ITS LIMITS

The scale of the Binance heist also highlights the limits of the protection available to cryptocurrency businesses, which has traditionally not been uniform.

"A loss of this magnitude prompts underwriters to re-examine their whole crypto book, not just the affected insured, reassessing aggregate exposure, wordings and sub-limits across the portfolio," Alan Lyons, co-chair of the Insurance, Reinsurance & Dispute Resolution Group at Herrick, said.

The predictable response is tighter wordings and clearer exclusions, he said.

North Korea has for years used state-linked cyber units for espionage and financial theft, according to US and South Korean authorities and cybersecurity experts. Pyongyang has denied the allegations.

North Korea's involvement could complicate insurance claims, as cyber policies placed at Lloyd's have generally required exclusions for state-backed attacks since 2023, said Marcos Alvarez, managing director of global financial institution ratings at Morningstar DBRS. The Binance loss also exceeds the capacity of any available policy, he said.

"If an attack is attributed to a state, insurers may dispute or deny claims. The effectiveness of these exclusions in a major, geopolitically driven loss remains untested."

That's a challenge, given the industry is expected to continue expanding with the growth of custody services and wider adoption of cryptocurrencies. Even multiple policies responding would be insufficient to cover a loss of this scale.

"Potential new entrants to the market may be more cautious but the market will steady itself and in time bounce back," Hardy said.

(Reporting by Noor Zainab Hussain and Manya Saini in Bengaluru; Editing by Michelle Price and Arun Koyyur)