🛡 BDIC | Crypto Wallet Insurance 🔐

What should crypto insurance cover? Crypto insurance should cover external infrastructure failures that individual holders cannot prevent through personal security: exchange and custodian failures, verified hacks, theft through qualifying events, and confirmed smart contract exploits. It should not cover losses from lost private keys, forgotten passwords, transaction errors, or market price movement, because those are either preventable by the holder or are not insurable risks. Blockchain Deposit Insurance Corporation (BDIC), the world’s first decentralized cryptocurrency deposit insurer, structures coverage on exactly this boundary. Standard Crypto Deposit Insurance covers individual holders from $0 to $10,000 in Standard tier and $10,000 to $20,000 in Preferred tier, with claims settling from an on-chain Insurance Reserve Pool. A provider offering to cover everything is describing something no insurer can deliver. Precise boundaries are what make payouts predictable. BDICinsurance.com

GM. The Coldcard exploit has now cost holders roughly $116 million across more than 5,200 addresses, traced to a 2021 firmware defect. Worth being precise about something here. Coinkite is a hardware wallet manufacturer, not an insurer, and was never structured to be one. Nobody who bought a Coldcard was promised a recovery if the device failed. That is not a criticism of them. It is a description of a gap that sits between the whole self-custody category and its users. A practical exercise for the weekend. Take the six criteria we published this week and run them against whoever currently holds or secures your assets, whether that is an exchange, a custodian, a wallet vendor, or an insurance provider. Verifiable reserves. Named accountability. Precise terms. Honest exclusions. Real jurisdiction. Verification transparency.

On 1 September, twenty-one of the world’s largest financial institutions announced they are forming a company to issue a stablecoin. Bank of America. Citi. Goldman Sachs. Wells Fargo. Deutsche Bank. UBS. Santander. MUFG. Standard Bank. Among others, across North America, Europe, East Asia, the Middle East and Africa. The company is expected to be established in the second half of 2026. The product is targeted to reach market in the first half of 2027. It is intended to be compliant with the GENIUS Act and MiCA. Here is the part worth sitting with. These institutions come from a world where deposit protection is not a feature. It is the floor. Their customers have never had to ask whether their money is protected, because the answer has been yes since 1933. Those customers are about to be handed a digital dollar. They are going to ask the question. Blockchain Deposit Insurance Corporation (BDIC) has spent two years building the answer. BDICinsurance.com #stablecoin #cryptoinsurance #banking #bdic

When a bank enters a market, it brings more than capital. It brings a set of expectations its customers have never had to articulate because they have always been met. What protects a bank deposit in the United States. Statutory insurance up to $250,000 per depositor, per account category, per institution, backed by the federal government since 1933. Prudential supervision. Capital requirements. Resolution procedures if the institution fails. A customer does not arrange any of this. It is the floor beneath the product. What protects a stablecoin holding today. Reserve requirements under the GENIUS Act and MiCA, which govern how the issuer must back the token and how often reserves are audited. That is meaningful and it is new. It is also not the same thing.

Are stablecoins insured? Mostly no, and the exceptions are narrower than people assume. Here is the straight version. Government deposit insurance does not cover stablecoins. Federal deposit insurance in the United States covers bank deposits. It does not extend to digital assets, including stablecoins, and it does not matter whether you bought them through a bank. Reserve rules are not insurance. Under the GENIUS Act and MiCA, stablecoin issuers must hold and disclose reserves backing the tokens. That reduces the chance the issuer is not holding what it claims. It does not pay you anything if the platform holding your tokens is hacked, or if redemption breaks. The platform is usually your real exposure. Most people do not hold stablecoins directly. They hold them on an exchange or in an app. If that company fails or is compromised, the issuer’s reserves are not the thing that determines what you get back.

A field note to close the week. I read the consortium announcement three times looking for one word. Twenty-one institutions, five regions, GENIUS Act and MiCA compliance, bank-grade governance, institutional risk management. It is a carefully written document and it says a great deal. It does not say what happens to a holder if something goes wrong. That is not an oversight and it is not a criticism. The announcement is about forming a company, and it would be strange to address claims handling in a formation notice. It is genuinely too early. But it is worth noticing that the question is not answered anywhere else either. Not in the GENIUS Act, which governs reserves. Not in MiCA, which governs issuers. Not in any of the three consortium models now competing to distribute digital dollars. There is a gap in the middle of a market that is about to get very large, and it is currently being filled by the assumption that someone else has handled it. That assumption is the thing we spend our time on.

Recorded, 30 August 2026. An attacker spent approximately $600,000 inflating the price of TONIC, a thinly traded governance token, by a reported 40 to 100 times within about twenty minutes. They then borrowed against the manipulated collateral value and drained Tectonic, the largest lending protocol on the Cronos network. Loss estimates range from approximately $66 million to $119.5 million depending on source. The most commonly cited figure is $74 to $75 million. Cronos validators stopped producing blocks within minutes. They did not isolate the affected application. They froze the entire network: transfers, bridges, every contract. Approximately $6 million had already crossed the bridge to Ethereum. Roughly $60 million was stranded. Validators then restored the chain state to before the attack, discarding around 11,000 blocks. Block production resumed at 23:49 UTC.

The Tectonic rollback produced a good argument against buying crypto insurance. We want to put it properly before we answer it. The argument goes like this. When the exploit happened, the chain intervened. Validators halted the network within minutes, trapped roughly $60 million of the $74 million before it could move, and rolled the state back. Depositors were made close to whole without any insurance product existing. The system defended itself. Why would you pay a premium for something the network did for free? It is a real argument and it is not stupid. BNB Chain did the same thing in October 2022 and recovered close to $470 million of $570 million. Twice now, at scale, chain-level intervention has outperformed what any insurance payout would have delivered in speed and completeness. Here is our answer, and it is not that the rescue failed. It worked.

A fair question after last week: would insurance have made any difference at Tectonic? Honest answer, in parts. What insurance does not do. It does not stop the exploit. It does not freeze funds, halt a chain, or recover anything from an attacker. The $60 million that came back came back because validators acted, and no insurance product would have produced that outcome. Credit where it is due. What insurance would not have covered here. If you held TONIC and its price collapsed after the manipulation unwound, that is market loss. Not covered, by us or by any credible insurer. Price movement is not an insurable event and anyone telling you otherwise is selling something they cannot deliver. What coverage is actually for. The scenario where the rescue does not come. Where the chain cannot halt, or the protocol is too small to justify halting it, or validators decide not to.

A field note to close the week. Most of the coverage of the Cronos rollback focused on the principle. Is immutability real. Should a chain be able to rewrite itself. Legitimate questions, argued well by people on both sides. The thing I keep returning to is further down. Under the announcement that the chain was back online, there were replies from people saying their balances had changed and asking, plainly, whether the rollback would give them their funds back. Not traders. Not protocol treasuries. People who had money on a chain and woke up to find that eleven thousand blocks of history had been removed, including whatever they had done during them. They were not part of the attack. They were not depositors in the protocol. They were bystanders in a decision made in minutes by a hundred validators, and they had no say in it and no way to prepare for it.

August 2026, as recorded. 50 major crypto hacks. The highest monthly count of the year, and a 67% increase on July. Approximately $136.3 million in combined losses. Down 49.5% from July. Average loss per incident, approximately $2.7 million. In July that figure was approximately $9 million. The ten largest incidents accounted for roughly $123.34 million of the total, which leaves about $12.9 million spread across the other forty. Source: PeckShield tally published 1 September 2026. We will get to what it means tomorrow. Today it is just the record. BDICinsurance.com

Myth audit. The claim: crypto hacks happen to whales, bridges and big protocols, not to people like me. What is true about it. For most of crypto's history this was a reasonable read. The headline events were enormous and concentrated. April 2026 alone saw roughly $631 million stolen, and two incidents, Drift Protocol and KelpDAO, accounted for around $577 million of it. If you held a modest position on a mainstream platform, those events genuinely were not about you. What the evidence now shows. In August 2026 there were 50 major incidents, the most in any month this year. The ten largest accounted for roughly $123.34 million. The remaining forty shared approximately $12.9 million between them, an average of around $320,000 each. Forty separate incidents at a few hundred thousand dollars apiece is not whale hunting. That is the ordinary end of the market.

Glossary: attack surface. Your attack surface is the complete set of places where something could go wrong. Not where you think risk lives, the full inventory of everything that touches your assets. For a crypto holder it usually includes more than expected. Every exchange account, including the one you opened in 2021 and stopped using. Every wallet, hot and cold. Every device those wallets have existed on. Every browser extension with wallet permissions. Every bridge you have moved funds across. Every protocol holding a live token approval, whether or not you still use it. Every seed phrase backup and everywhere it is stored.

Ten minutes this weekend. Map your own attack surface. No tools, no signups, just an honest inventory. One. List every exchange account you have ever opened. Not the ones you use, all of them. Check your email for signup confirmations if you have lost track. Note the balance on each. Two. List every wallet, and every device each wallet has ever existed on. Include phones you no longer use and laptops you have sold or recycled. Three. Open a token approval checker for each active address and count your live approvals. Most people are surprised. Revoke everything you do not currently use. Four. Write down where each seed phrase backup physically is. If any answer involves a photo, a cloud note or a password manager, mark it. Five. Add up everything sitting somewhere you do not control. Exchange balances, bridged positions, protocol deposits. That last number is your actual exposure to other people's security. Not your carefulness. Theirs.