The Spectacular Fall of FTX: Crypto Custody and Insurance Considerations

This morning, crypto exchange FTX (and over 130 affiliates) filed for bankruptcy in Delaware. FTX was recently valued at $32 billion, and now it appears to be worth $0. The bankruptcy petition listed at least $10 billion in liabilities.

The quick unraveling of the world’s second-largest crypto-trading platform this week may have been a solvency crisis, or a liquidity crisis (or one turned into the other, or both! ). And most of its in-house lawyers and compliance staff abruptly resigned three days ago. As a crypto exchange that offered futures and other leveraged transactions to investors, it re-mortgaged assets (tokens) in order to create the leverage desired by its clients. The FTX death spiral raises many good questions about coin custody and crypto insurance.

When people talk about stocks or cash, we rarely focus on custody. Either the money is in our pocket or it’s in a bank vault (maybe it’s locked in a safe at your house or under the mattress). The money is either somewhere you can easily get your hands on, or it’s at a physically secure (and highly regulated) financial institution. If it’s in a bank, it’s FDIC insured up to $250,000. And SIPC provides insurance for cash and certain securities in trading accounts at regulated brokers. Likewise, your experience of buying and selling stocks usually involves calling a regulated broker or trading them through an online broker (also regulated); but rarely handling physical stock certificates. Instead, for nearly fifty years, share ownership tracking and custody of stock certificates has been primarily done by The Depository Trust Company (owned by The Depository Trust and Clearing Company), and Cede & Company is the principal depository agent and record holder for the securities. Almost all freely tradeable corporate, stock, money market, and public company securities in the United States are registered and settled there.

This is not the case with cryptocurrency. None of this applies to tokens.

If your home is broken into and money is stolen, your home insurance policy usually has relatively low coverage limits. Cash insurance – by its very nature – involves a great deal of moral hazard. Similarly, a business owner’s property insurance policy may have limited cash, check, and title coverage. He could also have $1,000 coverage for good faith acceptance of counterfeit currency. But if a customer walks away with the cash register or a burglar destroys a safe, they may take more than the insurance covers. So many businesses buy a separate crime insurance policy to protect against the loss of money and securities both inside their building, and also when an employee makes a run to the bank. to deposit cash deposits.

But that is not the case with cryptocurrency either. Few people think about insuring their own cryptocurrency assets, perhaps mistakenly assuming that the exchange or custodian they use provides hack insurance.

Few people think about insuring their own cryptocurrency assets, perhaps mistakenly assuming that the exchange or custodian they use provides hack insurance.

Because crypto hacks happen. A month ago, it was reported that $570 million worth of BNB tokens from Binance had been stolen. Binance is the largest crypto exchange, by volume, in the world. Imagine if 2 million shares on the New York Stock Exchange, worth over half a billion dollars, had just evaporated from the floor of the stock market on a random Thursday? Good . . . they wouldn’t. Because the NYSE is just an exchange and not a depositary. The stocks being traded aren’t actually on the floor of the New York Stock Exchange, and the guys shown screaming on the stock exchange floor on TV don’t have a stack of physical stock certificates with them. Custody of shares and monitoring of ownership is primarily the responsibility of the Depository Trust Company.

Structurally, why is there a difference? There are a few reasons. In no particular order:

• Cryptocurrencies and trading methods (exchanges, brokers, etc.) are still relatively new. Their employees haven’t been to industry security meetings and conferences since the days of Jesse James, sharing information on how to prevent thieves.

• The regulatory environment – ​​which can be synergistic for client and custodian protection – for cryptocurrencies and exchanges still looks a bit like the Wild West.

• The nature of many cryptocurrencies is that they share certain characteristics with other bearer financial instruments (such as lottery tickets, casino chips, physical silver, or gold and silver). Just try buying something with a certified share of General Electric common stock. It is much easier to buy something with a Bitcoin or BNB token. (But I doubt anyone will take the FTT token from FTX today).

Which brings us back to insurance. We have seen time and time again that when risk origination is separated from risk retention, underwriting standards tend to fall. This happened with Lloyd’s of London (commonly misunderstood as an insurance company, but it’s actually an insurance exchange) which nearly collapsed in 1991-92. This happened with “origin to distribute” excesses with mortgage-backed securities and secured debt securities that fueled the global financial crisis of 2007-2010. This is why reinsurers insist on a right to information or audits from ceding companies.

In the world of cryptocurrency, exchanges have generally also been the repositories of assets. Coinbase is a good example. But other exchanges are structured to facilitate broader trading (with leveraged and futures contracts), with custody of crypto assets held elsewhere. This separation of risk origin (taking dollars from customers in exchange for tokens) from risk retention (where the tokens are stored, and what do you do when the customer comes back and wants to cash out their tokens or coins for dollars ) creates a situation where there are incentives for deteriorating coin security.

Anyone with a substantial amount of cryptocurrency should understand who has custody of the coins and whether the wallet is insured. Some exchanges are also custodians, some are not. Some are fully insured, some self-insured, and some have no insurance to cover the theft of your parts.

Some of the biggest name platforms (Coinbase, Bitstamp) are said to have crime policies with limits over a quarter of a billion dollars, underwritten by Lloyd’s and other major insurers. Binance would allocate a percentage of all trading fees to a self-insurance fund, which it claims is now worth more than $1 billion. Question if this is a remote bankruptcy, however?

The FTX US website says it has a criminal policy from Aon with limits of $7.5 million. That doesn’t seem like much for a company that a few weeks ago was worth $32 billion. But, the important fact is that the policy is for tokens in hot or hot wallets. For the majority of assets stored in cold wallets, it relies on BitGo to provide custody and insurance. And BitGo appears to have insurance with a syndicate of major London, Lloyd’s and European market insurers. With 9-digit limits.

Few companies carry insurance for crypto traders and investors to buy to protect themselves. The one that does this is Breach Insurance. He claims his “Crypto Shield” is the first insurance designed for crypto investors, rather than exchanges and other businesses that manage crypto assets. It is not available in all states and is limited to tokens on certain exchanges. It does not cover tokens held in third-party wallets. This therefore avoids the risk explained above. And the policies range from $2,000 to $1 million in coins. Coincover also provides cover for individual traders and wallets, with a product designed to cover theft by various methods (hacking, stock exchange security breach, employee theft, etc.) and is backed by Lloyd’s.

If you are a trader with $10,000 in Dogecoin held by a major exchange, there is probably a standard insurance policy. If you’re an institutional investor, fund, or business that accepts tokens as payment, and you have $100,000 or $1 million or more spread across multiple wallets and possibly multiple platforms, you’ll likely have different needs. Insurance decisions will vary due to different tokens, where they are stored, how they are stored, and who your counterparties are.

The token insurance market continues to evolve. On the one hand, you are focusing more on regulation. On the other hand, there are millions of dollars in losses every day. Some losses are considered hacking. Others – like last month’s $100 million loss at Solana-based Mango Markets – can be described as fair play to the rules (many people still call it a “hack”). It will probably be difficult to insure your Mango tokens. And there’s still old-fashioned attenuation; maintain strict control over passcodes and privacy keys and spread tokens across multiple wallets on different platforms to keep all your eggs in different baskets.