The cryptocurrency industry lost $3.63 billion to hacks over the past 19 months, yet the insurance safety net intended to absorb part of those losses is shrinking.

Active on-chain insurance coverage dropped 20.2%, from $163.2 million to $130.2 million, according to CoinGecko's 2026 State of Crypto Security Report released on August 27. That represents a $33 million reduction in available protection at a time when attacker activity has intensified.

The figures underscore a structural imbalance in crypto risk management: traditional insurance markets have historically hesitated to underwrite digital-asset risk, and the small on-chain alternatives that emerged — often protocol-based mutuals where capital providers pool funds to cover claims — have struggled to stay solvent against losses of this scale.

The coverage gap is widening fast

Five of the nine on-chain insurance protocols tracked by CoinGecko have either shut down or pivoted away from crypto coverage entirely as of August 2026. The reasons are consistent: high premiums, difficulty attracting capital providers willing to underwrite the risk, and the challenging economics of insuring an asset class frequently targeted by hackers.

Cumulative insurance payouts have remained near $33 million. That figure appears modest when compared with the $3.63 billion stolen across 245 incidents between January 2025 and July 2026, meaning insurance covered roughly 0.9% of total losses.

Infrastructure and supply-chain attacks were the primary methods used, accounting for more than $1.8 billion of the losses. The damage was heavily concentrated: the top ten incidents alone represented 72.5% of the total stolen value — a concentration pattern consistent with the industry's largest single exploits, such as the February 2025 Bybit exchange hack, in which roughly $1.5 billion in Ethereum was stolen and attributed by the FBI to North Korea's Lazarus Group. By definition, concentration of this kind means a handful of events can wipe out the entire on-chain insurance pool many times over.

What insurance actually covers (and doesn't)

Even the policies that do exist carry exclusions that make them far less useful than they appear. Most crypto insurance products do not cover phishing attacks, private key theft, employee errors, market volatility, or losses on unsupported chains.

The exclusion list matters because it maps poorly onto how losses actually occur: infrastructure and supply-chain compromises, the leading loss vector by dollar value, often involve attacker-controlled signing infrastructure — precisely the kind of edge case that policy language may or may not address, leaving disputes over whether a given exploit qualifies for payout.

Exchanges are going it alone

Facing an on-chain insurance market that is contracting and riddled with exclusions, major centralized exchanges have begun building their own safety nets. Binance maintains a self-funded protection reserve of approximately $1.16 billion — nearly nine times the size of the entire on-chain insurance market.

However, self-insurance only works for platforms with the balance sheets to support it. Smaller exchanges, DeFi protocols, and emerging platforms do not have a spare billion dollars available. For them, the shrinking insurance market means operating with essentially no financial backstop against a major exploit. The practical consequence is that in most hacks today, recovery depends on post-incident measures — blockchain forensics, exchange freezes, and law-enforcement asset seizures — rather than pre-funded insurance. How, or whether, the coverage gap closes will be a key signal of the industry's institutional maturity.