The breach that put an overlooked clause in the spotlight
On 29 October, Binance, the world's largest crypto exchange, suffered the biggest theft in the industry's history. Roughly $6.3 billion in digital assets moved out of its systems in a matter of hours, more than four times the previous record.
Binance's own account points to a compromised laptop belonging to a DevOps engineer, used to reach an internal system and push through unauthorised withdrawals. Binance has pledged to cover all customer losses using its reserve fund and corporate treasury and said it had replenished around 90% of the stolen assets using company resources within two days.
Blockchain investigators at TRM Labs linked the attack to TraderTraitor, the group the FBI has previously tied to North Korea's Lazarus Group, the same actors blamed for last year's $1.5 billion theft from the exchange Bybit.
Most businesses reading this will reasonably conclude it has nothing to do with them. Few hold crypto, fewer still run a hot wallet.
But sitting underneath this story is a clause that appears in many standalone cyber insurance policies written in the Lloyd's market, and that most policyholders have never had reason to read closely.
What happens when your attacker turns out to be a state?
Since March 2023, Lloyd's has required standalone cyber policies written in its market to exclude losses from state-backed attacks that significantly impair a state's ability to function, or that significantly impair a state's security capabilities.
The exclusion was designed with cyberwarfare between governments in mind, not ordinary commercial crime.
The trouble is that the line between the two has become harder to draw, and attribution has become much faster. After Bybit's theft in February 2025, the FBI named the North Korean group responsible within a week.
Industry commentators following the Binance case have already pointed out that cyber cover generally "is not going to cover anything when it comes to war or state-backed attacks", while also noting that wording varies from policy to policy and the exact boundary remains genuinely contested.
An insurer usually carries the burden of proving a war or state-backed exclusion applies, and a formal government attribution strengthens that case considerably. State-linked groups have increasingly featured in cyber incident investigations involving both public and private sector organisations, not just cryptocurrency exchanges.
If your own incident response ever produces, or a law enforcement agency ever publishes, a clear state attribution, the same clause could become highly relevant to any subsequent coverage discussion.
A reserve fund is not an insurance policy
Binance's Secure Asset Fund for Users, its main safety net, is reported to hold in the region of $1 billion, held mostly in bitcoin. Against a $6.3 billion loss, that fund alone covered under a fifth of the shortfall, with the rest coming from company treasury and other internal resources rather than a third-party insurer.
The pattern is not unique to crypto. Plenty of UK businesses rely on an internal contingency fund, a counterparty's informal assurance that "we'll make it right", or a modest crime or cyber limit bought some years ago and treat any of these as equivalent to properly sized third-party cover.
They rarely are.
A reserve fund sized for a bad year, not the worst year, behaves exactly like Binance's did: useful for a modest loss, and a long way short for a severe one.
Regulation is catching up, and directors need to catch up with it
The FCA's new cryptoasset regime, with final rules published this year and an authorisation gateway now open, extends a version of the Senior Managers and Certification Regime to cryptoasset firms from 2027.
Directors of newly authorised firms are likely to face greater personal accountability under the new regulatory framework.
Firms moving into this space, or advising clients who are, should expect their D&O conversations to change accordingly, since personal liability frameworks tend to follow regulation into a sector faster than insurance buyers expect.
A reasonable question, whatever sector you are in
It's worth asking your broker three questions:
- what does your cyber policy's war or state-backed attack exclusion actually say, and who carries the burden of proving it applies?
- If your business depends on an internal fund or a third party's promise rather than a sized indemnity policy, what loss would actually exceed it?
- And if a regulator is extending personal accountability into a sector you operate in, has your D&O programme been reviewed since that happened, or only since the renewal date rolled around?
None of these questions has a comfortable answer sitting ready-made.
That is exactly why they are worth asking now, while the Binance case is still making headlines, rather than after your own incident response team hands you a report with a government's name in it.
Could your current cover withstand a major incident?
Unsure whether your cyber, crime or D&O cover would respond to a major incident? Contact George Grimshaw on +44 (0)20 7280 3450 or at george.grimshaw@thecleargroup.com for an independent review of your insurance programme and a discussion about potential coverage gaps.
