Cryptocurrency Is a Massive Uninsurable Risk: Here’s How to Protect Your Assets

Cryptocurrency is growing in popularity and value, but its widespread adoption and volatility present risks that insurers are not equipped to cover yet.
By: | March 18, 2020

In April 2018, cryptocurrency advocate and investor Matthew Mellon died without leaving behind the “key” to his digital assets. In the world of cryptocurrencies, a key is a long alphanumeric string that confers access to the assets, in this case a cryptocurrency called XRP from a company called Ripple. Reportedly purchased for $2 million, the assets were valued at $500 million at the time of Mellon’s death.

Advertisement


That same year, Gerry Cotten, founder and CEO of Quadriga CX, a Vancouver-based cryptocurrency exchange platform, reportedly died, taking with him access to an encrypted computer containing the keys to an estimated $250 million in digital assets. As customers sued to recover their assets, there has been rampant speculation that Cotten may have faked his death.

In both cases, the lost assets remain unrecovered. In fact, it has been estimated that the keys to between 17% and 23% of all bitcoins have been permanently lost, effectively putting those assets out of reach forever. Bitcoin is the most well-known and established of the cryptocurrencies, but there are more than a thousand others.

Plenty of Risk

Plenty of people have made money investing in digital assets, and as the sector has matured, best practices have emerged. But risks remain, whether you are holding keys yourself or using a third-party platform.

“You could be holding those keys in the form of a hardware wallet, which is actually like a piece of hardware. You can hold them in the form of file on your computer. You can hold them in the form of words written down on paper,” said Andy Bromberg, cofounder and president of CoinList, a platform for managing digital asset sales.

“There’s a whole bunch of ways you can hold them. Obviously, all of those would come with their own risks.”

Cyber threats, including ransomware attacks, can be a major risk, depending on how the keys are stored.

“Cold storage is crypto that’s held offline, and hot storage is crypto that’s accessible,” explained Garret Koehn, regional director, Western U.S. for CRC Insurance Group.

Other risks stem from complicated user interfaces. “There’s not a great user experience built around them,” Bromberg said. “It’s easy to fat-finger something or do something else and have your crypto gone forever.”

Each time a digital asset is bought, sold or moved, there is a chance for something to go wrong. Cryptocurrencies can also fork, a process not unlike a stock split, which can also increase the potential for costly user error.

“Often, the exchange you’re using will choose to support one or the other, but not both,” Koehn said. “If you want to maintain the value of the fork, you have to open up another wallet and that starts to become cumbersome, as well. You risk potentially losing the value in those forks.”

Garret Koehn, regional director, Western U.S., CRC Insurance Group

Third-party platforms with better security can eliminate some of those risks, but they do involve counterparty risk. Many keys in one place is an attractive target for hackers.

Cryptocurrencies can be subject to extreme and often unexplainable price volatility, and liquidity can be another concern, especially for smaller or newer cryptocurrencies, where a single high-volume trade can have a big impact on valuation.

There have been multiple cases of “pump and dump” schemes and even cases where an entire currency was essentially a market manipulation scheme.

“They’ll build a following, they’ll start writing articles, and the day they go live, next thing you know, they have raised $1 million in 30 minutes,” said Kashif Khan, a vice president with Genpact in Chicago. “Then a month later, they’re gone.”

Embracing Regulation

Other risks include the potentially fluid regulatory environment that goes along with such a young and disruptive sector and can contribute to volatility. And contrary to conventional wisdom, digital assets are regulated.

“When people speak broadly about crypto and say, ‘Oh, it’s being used by drug traffickers and they’re hiding their money and bitcoin is really bad for that.’ The exact opposite is actually true,” Koehn said. “It’s more traceable and trackable than anything we have today.”

Advertisement


Bromberg agreed: “Crypto is fairly highly regulated right now. There’s not a lot of regulations specifically targeting crypto, but there’s a lot of regulation that applies to crypto. There is certainly regulatory risk in that if a country banned crypto, that could have an impact on price, but I think holistically, it’s actually pretty aggressively regulated right now. And I think that’s, net, a good thing for the space.”

While there was a time when the lack of regulation was part of what attracted some to invest in cryptocurrencies, the bigger players in the area are increasingly seeing the benefits of embracing regulation, not the least of which is increased insurability.

“Some of the big custodians have sought out relevant regulators at both state and federal levels,” said Jacob Decker, vice president and director of financial institutions at Woodruff Sawyer.

“Those who are identifying regulators, reaching out and working with them, have a much more favorable experience obtaining insurance than those who are looking for the lowest regulatory burden possible,” he said.

Insurance for Crypto?

Most cryptocurrency risks are effectively uninsurable for individual holders, apart from the nominal coverage that may be included in a homeowners or umbrella policy.

“Most homeowners’ policies provide a small amount of coverage for money, between $200 and $5,000 depending on the contract,” said Kurt Thoennessen, vice president and personal risk advisor at Ericson Insurance Advisors. “It’s minimal, because the policy is not designed to cover currency.”

But even that may not apply.

Kashif Khan, vice president, Genpact

“The homeowner’s policy does not mention cryptocurrency in the covered property sections, it refers to money, bank notes, bullion, gold, silver, platinum, coins, medals, scrip, stored value cards and smart cards,” said Thoennessen.

“However, it also does not exclude coverage for cryptocurrency. I suspect the homeowners contract language will be updated as cryptocurrency becomes mainstream to eliminate any ambiguities about the policy’s intent with regard to coverage.”

“There’s a discussion among the carriers and the carrier representatives and the agents and wealth managers as to, ‘Is there a feasibility to put together a product to insure cryptocurrencies?’” Khan said. “And the short answer is, ‘no.’ They are not prepared to have a product that’s going to insure cryptocurrency.”

Khan cites inadequate regulations, historical data and understanding of the causes of the extreme price volatility. “Insurers and actuaries and the actuarial departments are struggling to come up with a pricing model to ensure a commodity that’s so volatile.”

But some of the more-established third-party platforms are obtaining coverage.

“Coinbase is insuring about 2 or 3% of its balance with Lloyd’s of London,” said Khan. “And that’s how much risk they’re willing to take on.”

According to Decker, this is not entirely new. “There’s always been some level of insurability,” although he points out the pricing has reflected the high level of uncertainty and was probably accompanied by various exclusions and risk retention.

“It doesn’t mean that they’re not trying to put terms out and those terms aren’t being considered,” he added. “It just may mean that the gap is too wide for those deals to be happening on a regular basis.”

One key to putting such coverages together has been spreading the risk.

“In this industry, if it’s a buyer looking for a relatively large limit of insurance for some particular type of risk, I generally have to build it in much smaller pieces,” Decker said.

Some types of coverage are easier than others. “Different coverages come into play here,” Koehn said. “The big ones are: D&O has been difficult to do, depending on the type of company. E&O for blockchain is pretty easy to do, people aren’t scared of that. Crime is hard to do for hot storage. People can do cold storage. Errors and omissions, we can do typically successfully, generally. D&O for the ICOs [Initial Coin Offerings] is still difficult.”

Getting Up to Speed

Not surprisingly, the landscape is quickly changing.

Jacob Decker, vice president and director, financial institutions, Woodruff Sawyer

“Some very smart people are spending a lot of time trying to get up to speed to be in a position to write more business in this space,” Decker said. “And it’s evolving relatively quickly. There are more and more of these policies being placed all the time.”

Those looking to invest in cryptocurrencies can mitigate some of the risk, starting with which ones they buy.

“Don’t invest in coins that are outside of North America,” advised Khan. “You’ll see a lot of these pitches posing as American or Canadian, but they’re actually out of Russia or China or other countries. You want to stay away from that.”

Decker recommends hiring professionals.

“If it’s something that is not your core competency, my recommendation is to find an appropriate vendor or counterparty for which it is,” Decker said. “If … you’re not an expert in securing digital assets, hire a specialist who has the resources and the expertise to do it. Doing it yourself, to me, seems unnecessarily risky.”

Such assistance should be selected carefully. “Look for platforms that have been around for a while, have prominent investors that have been covered in the media, all the signals of a good, reputable business in the first place,” Bromberg said. “It’s the absence of those things that would make me concerned.”

Advertisement


Koehn agreed. “If you’re sticking to some of the big-name companies … they’ve got systems and models that are fairly normal that allow you to get into your account if you get locked out,” he said.

Finally, it may make sense to give special consideration to custodians or trading platforms that are insured. In addition to the coverage itself, insurance comes with the peace of mind that the platform has satisfied the insurers’ due diligence, which is probably more rigorous than what most individuals can achieve. &

Jon McGoran is a magazine editor based outside of Philadelphia. He can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

PART ONE: CRACKS IN THE FOUNDATION

Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.

PART TWO: BETRAYAL

As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.

PART THREE: FALLING DOMINOES

Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &

Bar-Lessons-Learned---Partner's-Content-V1b

Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.




Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]