Bitcoin Insurance in 2026: 7 Custody Models Compared

In November 2022, the week FTX collapsed, I wrote a Marty's Ƀent piece titled "Trusted Third Parties Are Security Holes." That title is borrowed from Nick Szabo's 2001 essay of the same name, which is one of the foundational cypherpunk arguments that led to Bitcoin existing in the first place. My piece was a 2022 application of Szabo's 2001 thesis. The argument was simple: the entire 2022 collapse cohort (FTX, Celsius, BlockFi, Genesis, Voyager) was the same failure mode at different exchanges. People had trusted a third party with their bitcoin. The third party blew up. The bitcoin was gone.

Three years on, the receipts are in. Every customer who got money back from FTX got it through bankruptcy court. Same with Celsius. BlockFi creditors got 100% recovery, not because anyone collected on an insurance policy, but because the trustee monetized BlockFi's claim against the FTX estate at a premium. Mt. Gox creditors are getting paid out in 2026 because BTC appreciated post-bankruptcy and the estate became larger than the original dollar-denominated claims. Quadriga creditors got pennies on the dollar through the bankruptcy administration after the founder died with the keys.

Zero of those recoveries came from an insurance policy paying out.

What's new in 2026 is that a real Bitcoin insurance market has finally emerged. AnchorWatch became a Lloyd's Coverholder in late 2024 and now writes custody coverage sized for institutional-grade Bitcoin holdings. Onramp placed a multi-institution facility at Lloyd's via Canopius. Resolvr is building Bitcoin-denominated insurance infrastructure that lets self-custody wallets route customer coverage through regulated carriers. Meanwhile is selling Bermuda-regulated whole life policies in BTC. The catch is that when "Lloyd's-backed" shows up in a custodian's marketing copy, it means seven structurally different things depending on whose name is actually on the policy.

Editorial disclosure: Ten31, the Bitcoin venture firm where I'm Managing Partner, led AnchorWatch's seed round. AnchorWatch is a Ten31 portfolio company. Unchained and Bitkey are TFTC sponsors. The other brands here I have no financial interest in.

This guide covers the seven structurally distinct models touching Bitcoin custody in 2026. Each one fits a different holder profile. At the end there's a decision matrix to help you pick.

• "Lloyd's-backed" means seven different things. The same insurance market backs everyone from BitGo to AnchorWatch. The variable that matters is whose name is on the policy.
• At every major Bitcoin custodian, the policy names the custodian, not the customer. Coinbase, BitGo, Gemini, Fidelity, Anchorage, Bakkt: same structural gap. Your protection is their solvency plus their security, not a policy that pays you.
• For most Bitcoiners, multisig is the insurance. A well-executed 2-of-3 with geographic key distribution eliminates the third-party risk insurance is designed to cover. Casa, Unchained, Bitkey, and Nunchuk hold this position openly.
• AnchorWatch is the rare model where the policyholder is named insured AND keeps keys throughout the active policy. Lloyd's-backed via Arch Insurance. Onramp ships a multi-institution variant that also names the customer.
• The 2022 collapse cohort recovered zero dollars through insurance. Every FTX, Celsius, BlockFi, and Mt. Gox payout came from bankruptcy administration. Not one policy paid out to customers.

At a glance: seven models, who's actually named in the policy

Seven categories. Seven different things "Lloyd's-backed" could mean.

The custodial gap: what "insured" actually means at Coinbase, BitGo, and Gemini

Let's start with the most consequential category, because most Bitcoin in the world is currently sitting inside it. The major custodians publish substantial insurance figures on their sites. Coinbase has a crime policy in the hundreds of millions, plus a smaller cyber sub-policy. BitGo has $250M base coverage with optional excess cover. Gemini built its own captive insurance company in Bermuda. Fidelity Digital Assets cites coverage "up to a billion." Anchorage, Bakkt, Nexo run the same shape.

If you read these as a Bitcoin holder, you can be forgiven for assuming you're insured.

You are not.

Read Coinbase's own legal language. The crime policy "does not cover any losses resulting from unauthorized access to your personal or business Coinbase account(s) due to a breach or loss of your credentials." SIM swap, phishing, credential theft, account takeover are all explicitly excluded. The portion of the policy that protects against platform-level theft is sized for Coinbase's hot wallet exposure, which is a small fraction of total customer assets under custody.

But the more important sentence on Coinbase's insurance page is this one:

"Coinbase will endeavor to make you whole, however, total losses may exceed insurance recoveries so funds may still be at risk."

"Endeavor." That's the operative word. The customer is not a named insured on the policy. The policy pays Coinbase. Coinbase then endeavors to pass the proceeds through. It's not a guarantee. It's a stated intention. Coinbase decides what happens to the money.

BitGo is more direct about this. On their own insurance solutions page:

"BitGo Bank & Trust, National Association maintains a $250M insurance policy on digital assets where BitGo Bank & Trust, National Association maintains all of the keys."

And:

"BitGo pays any and all deductibles since we're the party directly covered by the policy."

Read that twice. BitGo's marketing copy explicitly states that BitGo is the party directly covered. Customers can buy supplemental "excess specie" coverage through BitGo's broker if they want to be named on a policy themselves, but the base $250M does not name them.

This isn't a quirky crypto-custodian problem either. Mike Belshe, BitGo's CEO, framed it directly in an interview with David Lin earlier in 2025. Belshe was asked about insurance limits and pointed out that the same dynamic exists at every major custodian, including in traditional finance:

"There's only one guy that can write an uncapped insurance policy, and of course that's FDIC, and he writes uncapped insurance for US Dollars because they can print the dollars if they have to print them."

He went on to note that even BNY Mellon, the world's largest custodian and holder of trillions in assets, isn't insured for that scale. The math doesn't work. BitGo itself custodies over $100B with a maximum theoretical policy of around $950M between base coverage and excess. That's under 1% of assets under custody. And the policy is still named to BitGo.

Belshe's takeaway in that interview, in his own words: "Insurance matters, but security architecture matters more." He's the CEO of a $100B+ custodian and he's openly saying don't expect insurance to make you whole at scale.

Gemini, Fidelity Digital Assets, Anchorage, Bakkt, Nexo all run the same structural pattern. The policies are real, the Lloyd's underwriting is real, and the coverage exists. But the policies name the custodian as the insured. They protect the custodian against operational risk on the slice of assets they're sized to cover. They do not protect customers as named beneficiaries.

So if you have bitcoin at Coinbase, your protection is Coinbase's solvency, plus their segregation discipline, plus their operational security. Not a policy that names you. Same at BitGo. Same at Gemini. Same everywhere.

Custodial insurance is for the custodian. If you want a policy that names you, you need a different model.

Self-custody as insurance: the multisig answer

The first answer is the one Bitcoin was designed for: don't trust the custodian. Hold your own keys.

But there's a real argument behind this beyond the cypherpunk reflex. Multisig (specifically, a 2-of-3 quorum with the keys geographically distributed) is a form of insurance in its own right. It insures against single hardware failure, single location compromise, and what's become the dominant 2025-2026 threat: physical attacks on Bitcoin holders.

I wrote about this in April 2026 in a piece on the $5 wrench attack epidemic. Jameson Lopp's wrench-attack database documented 65 such incidents in 2025 alone, up 75% year over year. The Ledger cofounder kidnapping was the catalyst event but the trend continues. If your bitcoin is on a single hardware wallet at home, and someone with a wrench shows up at your door, you have two choices: comply, or get hurt.

The defense is not bravery. The defense is physics and geography. A 2-of-3 multisig setup where one key sits on a hardware device at your house, one sits in a bank safe deposit box in a different city, and one sits with a collaborative custody partner like Unchained or Casa is functionally wrench-attack-proof. The attacker can stand there with a wrench all day. You literally cannot produce two keys from one location.

This is the architecture I run for the meaningful portion of my own stack. It's the architecture Casa publishes openly:

"Using a multisig setup with keys stored in different locations ensures that even if you're under duress, you physically cannot comply quickly."

— Casa, The Bitcoiner's Guide to Physical Security

A few notes on architecture for anyone reading who's not yet running multisig:

• Mix hardware vendors in the quorum. Don't run three Coldcards in your 2-of-3. Run a Coldcard, a Blockstream Jade, and a Foundation Passport or BitBox. If a vulnerability is discovered in one vendor's firmware, your funds aren't fully exposed.
• Use a software coordinator that supports proper multisig descriptors. Sparrow, Bitcoin Keeper, and Nunchuk all do this well. Avoid wallets that demand custodial backup of the descriptor.
• Practice your recovery. A multisig setup is worthless if you can't recover from your backup. Do a dry run of restoring from two of three keys before you trust the system with meaningful amounts.

For most Bitcoiners with holdings up to a few hundred thousand dollars, well-executed multisig is the insurance. There's no policy to buy. The architecture itself is the protection. Combined hardware reviews live on the hardware wallets index; the multisig-specific coordinators I trust are reviewed at Bitcoin Keeper and Nunchuk.

Collaborative custody: the recovery layer for the people who shouldn't hold three keys alone

A lot of Bitcoiners read the previous section and think, "that's fine, but I'd lose my keys." That's a fair concern. Solo multisig requires real operational discipline. If you're not running quarterly recovery drills, geographic key separation, and a written succession plan, you're more likely to lose bitcoin to your own mistakes than to a wrench attacker.

That's the gap collaborative custody fills.

Unchained, Casa, Bitkey, and a few others all sit in roughly the same architectural lane: 2-of-3 multisig where the customer holds two keys and the provider holds one. The provider can't move funds unilaterally with only one key. But the provider also exists as a recovery backstop: if you lose one of your keys, they can co-sign with your remaining key to recover. If you die, your beneficiary works with the provider to access the inheritance flow.

Unchained's policy on insurance is worth quoting directly:

"Insurance is not available because client funds are never in the direct control of Unchained."

— Unchained help center

The cypherpunk model that insurance was built for is the one where a third party holds your money. Unchained doesn't hold the money. The architecture removes the risk that insurance is designed to cover. So they don't offer it. Casa, Bitkey, and Nunchuk hold the same architectural position, each in their own published materials. They treat multisig + procedural protection + (in Casa's case) features like Emergency Lockdown and a real customer service team as what they offer instead of an insurance wrapper.

A few notes on choosing within this category:

• Unchained is one of the largest collaborative custody providers and has the most mature Bitcoin IRA and trust account offerings in the industry. They're not available in NY, NJ, SD, or NC due to state regulatory issues. Long-time TFTC sponsor.
• Casa is the most consumer-friendly. Annual membership pricing, well-designed apps, the Emergency Lockdown panic-button feature, inheritance included. Pricing tiers go from a basic membership up to HNW-tier multi-key setups.
• Bitkey ships a Block-built (Square's sibling) hardware-and-software combo with a Trusted Contacts recovery model. In October 2025 they submitted a Bitcoin Improvement Proposal called Chain Code Delegation that fixes the privacy weakness of standard collaborative custody (where the provider knows your balance and addresses at all times) without requiring a Bitcoin protocol change. It's a notable improvement.
• Nunchuk is the multisig-first option for sophisticated holders who want the platform key to disappear automatically after a defined timelock. Best-in-class for inheritance use cases where you want the architecture to survive the company's failure.
• The Bitcoin Adviser sits adjacent: advisory-and-signer role rather than custodian. Useful if you want a Bitcoin-fluent professional in your quorum.

This category is where most serious Bitcoiners should sit. Multisig protection plus a recovery backstop. No insurance, because the architecture removes the third-party risk that insurance is designed to cover.

But there's a tier above this for holders with institutional-scale exposure or specific threat models: coverage for kidnap-and-ransom, inheritance bundled with underwritten coverage, the wrench-attack scenario at $10M+ where collaborative custody alone isn't enough.

That's where Lloyd's enters the picture.

AnchorWatch: self-custody with a Lloyd's policy that names you

In December 2024, AnchorWatch became the first US-licensed Lloyd's of London Coverholder dedicated to Bitcoin insurance. They write coverage sized for high-net-worth and institutional Bitcoin holdings. The structural innovation isn't the Lloyd's backing. Multiple custodians use the Lloyd's market. The innovation is that the policyholder is the named insured and the policyholder keeps a key in the multisig quorum throughout the policy.

AnchorWatch's product is built on Bitcoin-native primitives: miniscript-based multisig with timelocks and spending conditions in a configuration they call the Trident Vault. The keys are distributed between the policyholder and AnchorWatch. Neither party can spend unilaterally during the active policy. If the policy lapses, the vault doesn't fall apart. It degrades to pure self-custody. The customer never loses their keys.

This is what the lawyers and the cypherpunks both want: a real underwritten insurance policy that pays out in BTC-equivalent terms, backed by AM Best A+ rated Lloyd's paper, without requiring the customer to hand over their keys to a custodian. AnchorWatch holds a key in the quorum because the policy structure requires a verified co-signer. But they're not custodying the bitcoin. The customer is.

Coverage scales from a meaningful minimum up to figures that work for institutional Bitcoin treasuries. The pricing structure is publicly disclosed on AnchorWatch's site at anchorwatch.com/custody/pricing. Premium percentages move with vault size and coverage tier, custody fees are billed separately from insurance premium. The specifics will shift; the model won't.

Beyond the core custody insurance, AnchorWatch ships related lines: kidnap-and-ransom (Lloyd's-backed ransom reimbursement bundled with professional hostage negotiation), Bitcoin mining property insurance for operators with ASIC infrastructure, and the standard business-line products (D&O, cyber/tech E&O, general partner liability) for Bitcoin-native firms. The K&R line matters specifically because of the wrench-attack epidemic. AnchorWatch is currently the cleanest single-source for both the custody architecture and the response infrastructure.

The inheritance product, launched mid-2025, bundles Lloyd's coverage with a time-locked recovery flow that completes even if AnchorWatch ceases to exist. As of writing, it appears to be the only Lloyd's-backed Bitcoin inheritance product on the market. Casa, Nunchuk, Unchained, and Bitkey all do inheritance via multisig + procedural protection, which is excellent. AnchorWatch does multisig + procedural protection + a Lloyd's policy that covers the transfer event itself.

The deeper AnchorWatch review, with current pricing and coverage details, is on this site. The honest framing: this is the right product for HNW Bitcoiners, family offices, fiduciaries managing client bitcoin, and Bitcoin-native businesses with meaningful balance-sheet exposure. It's overkill for small holders. If you're at $25K of holdings and reading this, you're in the multisig-only tier. Go run Casa or Sparrow with a 2-of-3 instead.

Ten31 led the AnchorWatch seed. AnchorWatch shipped what Marty's Ƀent kept claiming should exist for years: a real Bitcoin-native insurance product where the policyholder is the insured. After three years of writing about why the FTX-era model was broken, I'm not going to soft-pedal the company that actually built the answer.

Onramp: the alternative for holders who don't want to manage hardware keys

There's a parallel model worth covering before we move on. Onramp places its insurance facility through Native at Lloyd's of London, with Canopius (the largest syndicate at Lloyd's) as the carrier. The amount is sized for institutional customer exposure, structured around their Multi-Institution Custody (MIC) model.

The MIC architecture is structurally different from AnchorWatch's keys-in-quorum approach. Onramp doesn't ask you to hold a hardware key. Instead, the bitcoin sits in a 2-of-3 multisig distributed across three independent regulated institutions: Onramp is one of the three, with two other regulated custodians holding the other keys. The institutions span multiple jurisdictions by design, so no single regulator can compel the funds and no single institution can access them alone. The diversification is the structural defense.

When does this beat AnchorWatch? When the holder doesn't want operational responsibility for a hardware signer. When they prefer a wealth-platform model (Onramp offers IRA, lending, advisory, and inheritance flows beyond just custody) over a pure-insurance product. When they want multi-jurisdiction diversification and are comfortable trusting three regulated entities collectively.

When does AnchorWatch beat this? When the holder wants to retain hardware key control. When they want the kidnap-and-ransom line bundled. When they want their inheritance to complete via Lloyd's coverage on the transfer event itself. When the threat model is sophisticated theft of a specific individual rather than diffuse custodian risk.

Both are real, both are Lloyd's-market, both have the policyholder as a beneficiary in a way Coinbase / BitGo / Gemini explicitly don't. They're different products for different holder profiles, not direct substitutes.

Resolvr and BDIC: the B2B infrastructure that fills the wallets you're already using

There's a third Bitcoin-native insurance company worth your attention, and it's the most architecturally interesting of the three. Resolvr doesn't sell insurance to Bitcoin holders directly. They sell insurance infrastructure to the wallets and custody platforms Bitcoin holders are already using.

Their product is the Bitcoin Denominated Insurance Collaborative, or BDIC for short. The idea is that compatible self-custody wallets can embed insurance routing into their existing customer experience. The customer doesn't change their custody setup. They pick coverage from a marketplace of regulated carriers, premiums and claims settle in bitcoin (over Lightning, on-chain, whatever the rails the wallet supports), and the policy names the bitcoin holder as the insured.

This solves a different problem than AnchorWatch. AnchorWatch is the right answer for someone willing to migrate into AnchorWatch's vault product. BDIC is the right answer for someone who's already on Liana Business (Wizardsardine), or who's holding through a specific custodian, or running a Bitcoin treasury company that already has its custody architecture decided, and who just wants regulated insurance attached to what they're doing.

Their initial GA launch partner is Liana Business by Wizardsardine, generally available in early 2026. It's the first commercial self-custody-with-insurance offering for organizations operating outside the AnchorWatch product surface. More integrations are announced through 2026. Marsh McLennan (the world's largest insurance broker) and Blockstream are named founding partners on the carrier side.

The Bitcoin-denominated piece matters more than it might first appear. Traditional insurance pays out in dollars. If you insure 10 bitcoin today and the price goes up 50% during the claims process, the dollar payout is for 10 bitcoin at the old price. You get fewer bitcoin back than you lost. For a Bitcoin treasury company with a strict accumulation mandate, that's a structural breach of fiduciary duty. Insurance denominated in bitcoin solves the mismatch.

A brief acronym note for the careful reader: there's an unrelated startup called Blockchain Deposit Insurance Corporation that also uses the BDIC acronym and is structurally suspect: funded through a planned utility token, no live product, vague regulatory framing. Resolvr's BDIC is the operational, venture-backed Bitcoin Denominated Insurance Collaborative. Don't confuse the two.

The retail tier and the international tier: Bitsurance and what's not yet in the US

Two more brief stops before the decision matrix.

Bitsurance is the European retail-tier answer. They're a German-licensed insurance broker partnered with a traditional European carrier (ELEMENT) and integrated with hardware wallet manufacturers including BitBox. Coverage runs from very modest monthly premiums up through HNW retail tiers. They never see your keys. They're a traditional indemnity broker covering financial loss from theft, burglary, extortion, fire, water damage, and physical attack. Currently Germany-focused with expansion across the EU. They're not currently available in the US. But they're the cleanest example of how the retail self-custody insurance market should look when it eventually exists at scale stateside.

State-run Bitcoin-denominated insurance has started to appear (Iran launched a maritime cargo product in mid-2026 covering Strait of Hormuz transit). I'd mention this only to acknowledge the BTC-denominated insurance frontier is real on a state level too. For US or Western readers, the sanctions exposure makes any state-run Iranian product non-recommendable.

What you might be looking for instead

A few things this pillar deliberately doesn't cover, because they're different categories and they deserve their own treatment:

• Bitcoin life insurance. Meanwhile sells Bermuda-regulated whole life insurance denominated in bitcoin. Premiums in BTC, cash value in BTC, death benefit in BTC. It's a completely different product category: tax-advantaged wealth transfer for long-term holders, not custody coverage. Worth its own piece.
• Bitcoin-backed lending custody. Battery Finance for real-estate transactions, Ledn for institutional and HNW retail loans, Debifi and Firefish for non-custodial multisig escrow loans. The non-custodial lenders use the multisig-as-protection model (same logic as Unchained on the custody side). The custodial ones inherit their custodian's policy structure, which means the named-insured gap applies there too.
• Generic crypto crime insurance for exchange businesses. Evertas, Canopius's broader programs, Relm, Boost. Competent insurers covering real risks for crypto businesses. They cover assets across the broader crypto category: ETH, stablecoins, DeFi positions, exchange holdings. Nothing wrong with the underwriting; just nothing in those policies for a Bitcoiner who isn't holding any of it.
• DeFi insurance protocols like Nexus Mutual. Smart-contract risk insurance for assets that wouldn't be in this discussion at all. Skip.

Decision matrix: what fits which holder

Pricing tiers and dollar minimums shift across these products. They'll be different by the time you read this. The model fit is more stable than the numbers. Use this matrix to figure out which category you should be in, then check current pricing on the linked product pages.

Worth saying plainly: most readers of this site sit in the first or second row. Multisig is the right answer for most Bitcoiners. The Lloyd's-backed tier is for serious institutional and HNW use cases.

What to actually do this week

If you've made it this far and you're holding bitcoin on Coinbase, BitGo, Gemini, or any major custodian, take an action item. Even a small one.

If you're under $50K and have never set up multisig: download Sparrow Wallet this weekend. Order a Coldcard or Blockstream Jade. Practice a single-signer setup until you're comfortable, then graduate to a 2-of-3 multisig with a collaborative custody partner holding the third key. Total cost is under a few hundred dollars. Time investment is real but bounded.

If you're at $50K-$250K and already self-custodying single-signer: this is the single biggest upgrade you can make. Move to 2-of-3 multisig with geographic distribution before the wrench-attack curve hits you. The Unchained, Casa, and Bitkey options all do this well.

If you're at $250K+ and serious about custody: look at the AnchorWatch and Onramp options. Compare their pricing and architecture against your actual threat model, not against a vague "insurance is good to have" instinct. Decide based on whether you want to hold a hardware key (AnchorWatch) or prefer multi-jurisdiction distributed custody without managing a signer (Onramp).

If you're a Bitcoin business or fiduciary holding client bitcoin: the BDIC-via-Resolvr integration partners or AnchorWatch's institutional tier are the only real options. The custodian-named policies at BitGo / Coinbase Prime / Gemini Custody don't meet fiduciary standards for protecting client bitcoin.

If you're outside the US: Bitsurance is the cleanest retail option for European holders. Watch the BDIC integration rollout. There will be more options by mid-2026.

Frequently asked questions