Self-Custody Insurance: Protecting Your Bitcoin without Giving It Up

All right. We're wrapping up the conference here on the Enterprise Stage with a discussion about insurance. So everyone in here is a glutton for punishment, apparently. But no, I think you're all the most concerned about your Bitcoin, and you want to make sure that it's protected.

​

I'm Aaron Daniel, co-founder and CEO of Resolvr. We're building insurance technology that connects the insurance industry to the Bitcoin economy. We've got an amazing panel here of pretty much everyone in the Bitcoin space who's working on insurance products, but not just any insurance products: products that will help you insure your Bitcoin in self custody. Sovereign Bitcoin that's insured.

​

My name is Chris. I'm the CEO of bitsurance. We launched in 2021, and in 2022 we signed the very first policy to insure Bitcoin in self custody against physical risks: $5 wrench attacks, fire, water, extortion, these things.

​

I'm Kevin Loaec, CEO of Wizardsardine. We're a Bitcoin security company, and we built a wallet called the Liana wallet, which currently has an integration with Resolvr to offer insurance on your self custody.

​

I'm Rob Hamilton, co-founder and CEO of AnchorWatch. We are a Lloyd's of London coverholder offering Bitcoin insurance for your bitcoin in cold storage using our Trident Vault, which Kevin and I will have a lot of fun talking about with Miniscript shortly. Not too much, I promise. We won't get too technical.

​

So, insurance on self custody Bitcoin. But qualified custodians and exchanges have insurance policies. Why shouldn't I just put my bitcoin there if I want insurance?

​

It's a great question. It's one that I think all of us on stage have probably gotten at some point. It really comes down to the details of what the insurance policy is. Immediately, as a term of art, it is typically a third-party policy, meaning you as a customer at these exchanges are not actually on the insurance policy. The person who is the custodian has an insurance policy.

​

Further, there is typically a disproportionate amount being custodied versus the limit on the insurance policy. This is just a structural insurance problem. If you are at a single point of failure, at a single custodian, there is a concentration and aggregation of risk that makes it not economically viable to have 1-to-1 insurance. Coinbase maybe has a $350 million policy. They have $300 billion of assets under management. So you start understanding the scale pretty quickly, and the power of being able to get your Bitcoin insured in your own self custody.

​

Exactly. What you care about is basically not losing your bitcoin, so having insurance where it's 1-to-1 denominated, and you know that if you lose your coins today, you're going to get the same amount paid out by the insurance company, is basically what you want. This is very important because most of these custodians or exchanges, every time there is a problem, and we see problems all the time, you go to a five-year-plus payout period where the claims are denominated in dollars. Again, it's really not insured to the level of the holdings. When you see the payouts for things like Mt. Gox or whichever happened since then, it's really tiny compared to what you would have had if you could just have your bitcoin insured in the first place.

​

Bitcoin as an asset, if you have it on Coinbase or if you only have exposure through an ETF, you're foregoing a lot of the great qualities of Bitcoin. We set out to insure Bitcoin in self custody. We want to remove the counterparty risk, but we also want to be the final piece of the puzzle. We are not the first piece. Your setup is what you take care of, but the risk of physical scenarios that threaten you can be taken care of with insurance. We never touch a private key. You stay in full control, but you have much more security.

​

Everybody up here is going about insuring self custody bitcoin a little differently. Can you explain your process?

​

We launched as a B2C product with low limits, and we are directly integrated in the most popular hardware wallet in Europe, the Bitcoin-only edition of the BitBox. The idea behind that is we want to give two kinds of customers the option to have insurance. First, the people who, for the first time ever, move their coins off an exchange into their own self custody. They enjoyed insurance on the exchange, and now their friends tell them, take it into self custody. With it, they can have a very small policy for 0.3% of the covered sum.

​

On the other spectrum, we insure high net worth individuals who fear that the threat of a $5 wrench attack, extortion, or robbery threatens not their Bitcoin, but their skin. We want to protect your skin and give you the option, a negotiation chip, where you can give up your bitcoin knowing that it will be replaced through insurance, in the hopes that you're not getting abducted, something that we've seen very much on the rise.

​

So what you're talking about there is not 100% of your policyholder's Bitcoin would necessarily be on one Trezor, for example, or one BitBox, but it's a significant amount that is insured. It's an amount that, if there's an attacker, you give it to the attacker. They see, oh, it's €100,000, this is probably all you've got. I'll take that. Meanwhile, the rest of their stack is somewhere in a multisig or something like that.

​

After a certain amount of bitcoin, I always recommend having a multisig, a geographically distributed multisig. You can play with time locks. If somebody threatens you or your family, you can take out the flip chart and draw the charts and tell them, oh, I can't access it. Maybe that is convincing to some robber, but maybe somebody will pull out your fingernails. Having just a small amount, even €10,000 or €50,000 worth of insured bitcoin on an old Ledger or on a secondary hardware wallet might just be enough. We've seen cases in France where people have been abducted for as little as $6,000. If you can say without resisting, here, take it, be gone, maybe that will save your health.

​

To add to that, it's clear from what you said that there are different risks that can be covered with insurance. You don't have to cover all of them. You can choose what you need and what you want. Of course, the technical offering is also different. What we can do with Liana is very different from what you can do with AnchorWatch. We cannot give you insurance against theft or against ransom just because of the way the wallet works. You are in full control. We are not a cosigner. There is no one to verify the legitimacy of the transaction you're sending outside of your wallet, because you are in control. It's just your wallet.

​

What the insurance can cover here is loss. If you lose all your keys and you cannot recover them, we have a system where a trusted third party can hop in and try to recover your coins. If this trusted third party just cannot recover your coins, then this is insured and you basically get your bitcoin back. But with this design, we cannot prevent theft because you have the keys. It's up to you to verify what you're signing. So there is also a choice to make between what kind of coverage you want and how much control you are willing to give away.

​

I would add to that, and you mentioned the word cosigner earlier. That's the core premise of what we've built with Trident Vault. When AnchorWatch was originally founded in 2022, I remember having a conversation with my co-founder Becca around not wanting to get deep into the technical stuff. We just wanted to manage the insurance piece. We realized over time that to be able to build at scale an insurance solution, we had to go down to the foundational layer of the Bitcoin blockchain.

​

We leverage Miniscript. I promise I won't get technical, but it allows us to encumber more advanced spending conditions. Primarily, the way we use it at AnchorWatch is that we serve the role of a cosigner. That means that for the length of your insurance policy, any time funds need to move, we have to actively participate in the process. That requires its own back-office operation for checking the integrity of the transaction, making sure it's going to the right destination, making sure you're not under duress, and overseeing the safety of your vault.

​

Fascinatingly enough, as a cosigner we're able to link behaviors that can increase or decrease risk with your insurance premium. We have what we call the HODL discount. If you have no intention of sending your Bitcoin at any point, and this is your deep cold storage, once we set up your vault, we turn off the send Bitcoin button. You can't even execute a transaction without us. The UI won't let you do it. If there's an incident or some reason why you need to, you can reach out. That allows us to lower premiums, because Bitcoin is most often at risk when it's in flight and being moved. Once the bitcoin arrives at an address, assuming the keys are secure, there aren't going to be things happening. Monitoring the transactions at rest as well as in flight allows you to provide this comprehensive security solution.

​

That brings up another question that I think everyone gets asked up here, and that relates to insurance fraud. How do you know that someone who has one of these insurance policies hasn't just committed fraud, lied that they lost the keys, and they're really hodling it, or they gave it to their children and it's a forced HODL? What are the different ways that, as insurers, you are mitigating against that risk of fraud, which is one of the single greatest things an insurance company has to concern itself with?

​

As with any insurance, if there is an insurance claim, I am the claims authority. We have a plausibility check. Depending on the amount, the FBI equivalent would be involved. With everything that is insured, like watches, fine art, gold bars, all of these things are much easier to fake or commit fraud with. With Bitcoin, I can to a certain extent track and follow the money without even putting pants on. Please do.

​

I have been in this industry and I'm very familiar with the ways to have enhanced privacy on-chain. It is quite difficult. We protect against outright fraud by, so far, insuring lower limits comparatively in countries where it's not that interesting to look ten years over your shoulder for half a million euros. There are easier ways to make money. You can always turn criminal, but don't try us.

​

For us, technically, we only allow insurance as a service over loss, so it's much easier. If the user just moved their money elsewhere, that is not insured. What we're insuring against is the loss of their keys. If they lose their keys, as I was saying earlier, what we're using is a time lock, again with Miniscript. After a time lock, a third party, typically what you can call a custodian, but they are not really a custodian in this case, they are a recovery partner, has a key. When the time lock expires, so when the funds haven't moved, let's say for more than a year, the third party would be able to recover your coins and send them back to you. If this third party also lost their keys, and again, they are a professional, typically regulated entity, the insurance that is covering them is going to pay out. So the risk of fraud here is pretty much nonexistent. It is very different depending on the type of risk.

​

Taking a half step back, Bitcoin as an asset in the risk markets is usually called under the specie market. If my wife's engagement ring were insured and we wanted to stage insurance fraud and hide the ring, collect the payment, and get the ring back later, that is infinitely easier than doing that with Bitcoin. Bitcoin is a transparent ledger of transaction activity and history. Even proving you lost keys, if someone went to go file a claim and said, oh, I lost the keys, but you saw there was a transaction the day after the claim pays out, not really a great structure.

​

Additionally, we also use a recovery partner in a slightly different context. In the last 30 days of your insurance policy, AnchorWatch, as well as a third party, CoinCorner out of the Isle of Man, a long-running Bitcoin exchange, are able to work with us to return the Bitcoin back to you. Bitcoin is such a great asset to insure.

​

That's a great point that compared to something like physical jewelry, Bitcoin is a much better risk from an underwriting perspective. Is that playing out in the premiums that people are seeing on Bitcoin versus something like fine art or jewelry, or are we still bringing the insurance industry along to understand the benefits that Bitcoin the technology has natively to make it that better risk asset?

​

We are very early in this industry in insuring Bitcoin. When we started, me and my founders went and talked to all of the insurance companies in Europe, and most of them laughed in our face. Then FTX happened, and suddenly you get calls back. The risk that an insurance company takes on, usually a lot of these risks are connected, whereas with Bitcoin, that is an entirely new product. The number of claims is not geographically concentrated, and that makes it a very interesting insurance product.

​

So far, since it's such a small market, and any insurance product is only as good as the math behind it, we need much more data in order to be able to lower the premiums. We have 0.3% as the premium that we are targeting, and we are quite competitive that way if you compare it to regular watch insurance. I agree Bitcoin is much easier to insure, but it is very difficult to explain to insurance companies why that is, unless you're dealing with Bitcoiners. So we are working on that.

​

As with everything, we need to have the risk spread out across a lot of users for it to make sense for the insurance company. This is why, of course, an insurance company cannot just offer 1-to-1 insurance on Coinbase. If Coinbase has an issue, your coins disappear with everyone else's coins and the insurance company is going to go bust. That cannot work out.

​

But it works in self custody or in individual user-segregated wallets, where each user is covered separately, again with Miniscript and time locks. From a technical aspect, I think it's important to explain it here, especially if anyone in the room is working for an insurance company. The risk that the recovery partner gets hacked, their keys are compromised, or they lose their keys, is not that the funds are lost. The users still have their keys normally. The only funds that would be lost are the ones from the user who lost their keys and has not recovered yet. So we're talking about a tiny fraction of the total number of insured users that you would have to cover for.

​

The risk is extremely low, even for a large number of bitcoin, even if it's just one recovery partner you're covering, because the recovery partner is not a custodian in this sense. They do not control the money. They do not control the coins. If they mess up and they lose their keys, they can just send an email to all the customers and tell them, hey, you should rotate your coins to a different wallet because your recovery is not going to work. Nobody lost money this way.

​

I think it's really a cheat code for the insurance company at this stage. It's pretty much a nonexistent risk that they are charging huge premiums for. I'm sorry, but I don't think anything is competitive in this space right now. It's a huge premium of free money they are making out of potentially very large wallets, just because people are used to taking insurance over things, including their bitcoin. I don't even think they need to have insurance. I think technically this is good enough. The setups we have are good enough. You do not need to take insurance. You might want to for regulatory reasons, for making your board happy, or whatever, but the risk of even triggering the insurance is tiny. So I really hope insurance companies are going to drop the premium to sub-ten basis points, something like that. Soon, but not too soon.

​

The way I would think about this, going back to your question about the rates online and the evolution of the industry, is that there's an important bifurcation between the panelists here on stage doing self custody, which is relatively new, versus the specie markets underwriting the larger custodians. That's been going on for over a decade. I believe Coinbase's first policy was in 2012 or 2013, and they've had well over a decade of data and information gathering to be able to understand and underwrite that risk better.

​

I think that's really important context for understanding the economic viability. I agree with Kevin in the long arc of history, as more data gets aggregated and practices get standardized, there will be a natural matching of supply and demand of capital. You see a version of this too with Bitcoin-backed lending. The rates for a Bitcoin-backed loan are astronomically higher than what you would need for any other asset that you were borrowing against. It's about a conversation. Insurance is a very long, iterative game of many years and collecting lots of data. This is why the industry is so early as being part of that infrastructure.

​

I think over time it's going to have more and more importance. When you think about things like getting a mortgage against your house, you get an insurance policy on it. The bank won't close the mortgage until there's a homeowners insurance policy on it. I think in the longer arc of history, the actual banks of the Bitcoin ecosystem will be insurance companies. They're the ones that are going to have the balance sheets to be able to underwrite these risks and understand it. If you are trusting your Bitcoin with someone, you want someone with balance sheet strength. If you're a very large publicly traded company, you don't use a regional bank. You use one of the global systemically important infrastructure banks. In that long arc, the insurance companies are going to be the banks.

​

This is the nascent stage of developing out the data, understanding product development, understanding how to properly structure things, getting loss and claims data, and iterating on policy wording. If Bitcoin is an intergenerational project, getting the insurance infrastructure fully distributed to the point where Kevin wants is going to take another decade or two decades. That's okay, because there's a lot to build in advance and move forward.

​

What I'm hearing is that right now, insuring self custody bitcoin, there's an asymmetric opportunity for those who understand the risk and those who don't. Those who can enter into the market and start underwriting this risk now will start developing a larger data set, have more refined models, and have a first-mover advantage against other insurance companies. Those with larger amounts of Bitcoin now have the balance sheet strength to start on this currently. So any treasury companies listening who want to be the next banks should start getting into insurance. Is that what I'm hearing?

​

Yes. Every time I hear Warren Buffett invoked about being the Berkshire Hathaway of Bitcoin, do you realize it's an insurance company? Having a capital balance sheet and putting it to work is the future, for sure.

​

I completely agree. We hear a lot about Bitcoin yield, but I really think insurance is very low-risk right now on Bitcoin compared to the actual premiums they are charging. That's the kind of yield you can do with a large balance sheet. Sure, it's not going to be 2%, but hey, it's something.

​

We've talked mostly about coverage for loss and theft. We hinted at $5 wrench attacks. What other types of coverages exist in the marketplace today that can complement the loss of your Bitcoin and mitigate against the threats that Bitcoiners face when they're holding Bitcoin in self custody?

​

For risks like kidnap and ransom, at AnchorWatch we do broker K&R insurance if you are interested, whether as an individual or a company. As for this part of the risk, it is actually part of our policy. In the event that there is violent coercion, we will be able to have that as part of our covered losses as it relates to this risk in particular.

​

I think this is just going to evolve over time. Right now, the low-hanging fruit is people with Bitcoin and digital assets to target. Criminals are getting more sophisticated in general. There are also just very hostile government policies. There are certain countries like France and Sweden where, in France, someone who worked at the tax authority was giving tax returns of people who were selling bitcoin to criminal networks to then go target their houses. I believe in Sweden all tax returns are public, so you just scroll the database, set an open call, and say, give me every single filing that has bitcoin sales or buying, and then criminals just get a wish list of where they should go knock on doors. Those kinds of loops will get tied out over time, but in general, on the internet, criminals are getting more sophisticated and trying to understand how to attack new wealth. It's a risk everyone should be aware of and think about.

​

That's the unique thing about Bitcoin. I always say in my neighborhood I'm probably the poorest person, but I'm by far the richest person based on the things that you can beat out of me. My neighbors have houses, they have boats. I only have Bitcoin.

​

You're a big piñata.

​

Yes, I'm a big walking piñata, and there is a target on my back. Insurance was the only solution that I saw. As you mentioned in France, every two and a half days right now is a $5 wrench attack. Somebody is getting abducted, somebody is getting hit. In those cases, from the point of view of the robber, two-thirds are very successful. They end in mutilation. They end in actual physical altercations, and weapons are involved. That is not just street criminality. Those are proper criminal underground organizations. This is just going to increase over time, because Bitcoin as an asset will do another 10x or 100x. Everybody who posted about Bitcoin in 2017 theoretically enjoyed 100x and is potentially a target of this. Again, I don't see any other solution for how to secure self custody other than insurance.

​

That's an interesting point as well, because over time in Bitcoin, we've made sure, and we keep doing it, that the security of your Bitcoin is good and getting better. We're making sure the random person hitting you with a hammer is not going to get your bitcoin. Technically, we can do that. But it doesn't solve the problem that someone is hitting you with a hammer. That's where insurance can help.

​

If we can recap the panel's major points: self custody exists, you should insure it, you can insure it with any of these companies up here, and it is a better insurance policy than you'll get with a custodian. If you're from the insurance industry and listening, Bitcoin is actually a more insurable risk than any other financial asset in history.