Every bitcoin holder wants maximum protection. Far fewer will pay for it, and the gap between those two positions is where custody businesses are actually built.

This report, authored by Onramp Founder & CEO Michael Tanguma, works through what insurance can and cannot do in bitcoin custody, what the market charges for it, and what custody genuinely costs to operate.

The through-line is pricing: what a provider charges, for custody and for coverage, reveals more about the security underneath than anything in a pitch deck. It closes with how Onramp's insurance program was built with Lloyd's of London, working alongside Native, the regulated broker on the custody policy, who published a companion case study on how the coverage was structured, and why underwriters had to build a new category to cover Multi-Institution Custody.

What pricing reveals about Multi-Institution Custody and the economics of protecting bitcoin.

Abstract

Every bitcoin holder wants maximum protection. Far fewer will fund it, and the distance between those two positions is where custody businesses are actually built. This report works through what insurance can and cannot do in bitcoin custody, what the market charges for it, and what custody genuinely costs to operate. The through-line is pricing. What a provider charges, for custody and for coverage, reveals more about the security underneath and the durability of the provider than anything in a pitch deck. All of it can be built, and we intend to build it; the order is the hard part, because each addition has to be paid for by the model it joins. We close with how Onramp's own program was built with Lloyd's of London, and what the process of obtaining it says that the policy alone cannot.

1. The oldest rule in business

There is a difference between what somebody wants and what they’ll pay for.

Ask any bitcoin holder what they want from custody and the list is beautiful. A 3-of-5 quorum across independent institutions in named jurisdictions: Singapore, the UAE, Switzerland, El Salvador. Keys generated in secure ceremonies they can verify. A seat in the quorum reserved for the client themselves. Around-the-clock monitoring. Inheritance built in. And, while we're dreaming, a dedicated insurance policy with their name printed on it, covering every satoshi one-to-one.

They want all of it. Ask what they'd pay for and the list gets short fast.

That gap is the market working, not failing. You can insure almost anything; there is an underwriter somewhere for every risk at some price. Nobody insures a shirt. Insurance earns its premium when a loss would be catastrophic and the risk cannot be engineered away. So the existence of a policy tells you nothing about a custody model. What risks the model still carries, and who pays to cover them, tells you everything.

Every item on that list is buildable, and we intend to build all of it. Sequencing is the discipline. Onramp has been deliberate about what comes first and what comes later: pioneering Multi-Institution Custody cost more to operate at the start, and scale has driven that cost down to the pricing clients see today. Each new capability has to arrive the same way, funded by the model rather than bolted onto the fee.

2. The barbell

“Insured” is the least informative word in the custody market. Until recently, bitcoin insurance offered two structures and nothing sensible in between.

At one end, the pooled custodian policy. The large omnibus custodians hold tens of billions against coverage that amounts to a rounding error of assets. The structure is deliberate. Pooling client assets in omnibus accounts, with a fractional policy over the top, is what allowed the large custodians to scale custody at economics that make sense for their business, and it maps neatly onto the traditional finance custody model their buyers already understand. One of the largest states in its own help documentation that total losses may exceed insurance recoveries, so customer funds may still be lost. Another advertises a $250 million policy that applies only where it holds all keys. Coverage at this end is marketing. The pool is the exposure, and the policy is a fraction of the pool.

At the other end, the bespoke self-custody policy. This was the answer the market gave bitcoiners, and most assumed it was the one they would adopt when the time came: hold keys in a collaborative vault, buy a dedicated, one-to-one policy in their own name. Then they priced it, and saw what implementing it actually involves. The going rate runs 0.40% to 0.80% of assets per year on top of custody fees, with floor premiums around $4,000 per $1 million insured. Price out an illustrative $5 million vault at the top of that range: $40,000 a year in premium plus roughly $12,000 in custody fees, about $52,000 a year all-in, and past half a million dollars across a decade. At application the client selects a deductible of 10% to 25%, so coverage on that vault starts $500,000 to $1.25 million underwater on the day it's needed. When a loss occurs, the claims process investigates the client: transaction records, key handling, compliance with the policy’s procedural conditions. And the prerequisite for the product is becoming a keyholder, which means keeping precisely the risks the policy prices.

Bitcoin insurance had a barbell problem: trust a single-custodian policy that never covers 100% of assets, or insure a bespoke self-custody setup at cost-prohibitive premiums. Multi-institution custody collapses that barbell entirely. It changes how risk is underwritten and restructures the economics of insuring bitcoin at scale.

3. What actually protects bitcoin, ranked honestly

More bitcoin has been lost behind a false sense of security than to the absence of an insurance policy. Exchange customers felt safe until the pool turned out to be a fraction of the assets. Hardware wallet holders felt sovereign until a device exploit, a seed phrase in a fire, or a five-dollar wrench turned a single point of failure into a total loss, and the past few weeks gave the market a fresh reminder of how that goes. In every era of this asset class, catastrophic losses came from architecture nobody examined, sitting behind an assurance everybody trusted.

Ranked by what actually prevents loss:

1) How the key material is generated and safeguarded

2) How keys are distributed: independent institutions, no single point of failure

3) Who can move assets: a quorum the client directs and no single company controls

4) Verifiability: your vault, on-chain, checkable at any time

5) Continuity: inheritance and recovery that survive any single institution failing

Insurance is real and it matters. It should never crack that list. When a custody pitch leads with the policy instead of the architecture, ask why the risks being insured still exist in the model at all.

4. What custody actually costs

Run a custodian honestly and someone has to get paid for all of it: key ceremonies and signing infrastructure, geographically distributed operations, monitoring and incident response, withdrawal verification, compliance under independent review, annual third-party audits, and the insurance program itself. That stack is the baseline cost of custody done properly, and it barely varies between competent providers. The market is still maturing around this point, but the direction is set: paying for custody in bitcoin is a feature, not a bug, when it is done the right way.

The single-custodian world has never had to charge for that stack honestly. An exchange can offer custody cheaply, even free, because custody is not the business. Trading fees, spreads, lending, and order flow pay for it, and the custodied assets are what feed those revenue lines. When custody is free, the custody was never the product. The same logic reaches beyond exchanges: any provider whose economics depend on an adjacent line of business will price custody as the wedge and make the margin somewhere else.

Multi-institution custody cannot play that game, and this point is underappreciated. The best analogy is banking before fiat, when a bank's business was safeguarding clients' precious assets and it earned a market-clearing fee for exactly that. The fee was the product, and everyone understood what it bought. In a genuine multi-institution model, three distinct regulated entities each hold key material, each maintain their own security operations, compliance programs, and audits, and each must earn a return for standing behind the quorum. The coordination among them is real operational work, and every party in the structure has to share in the economics or the structure doesn’t exist. Honest multi-institution pricing will therefore never be the cheapest headline in the market. That difference over single-custodian pricing is not margin. It is the cost of removing the single point of failure, paid to the institutions that actually remove it.

Which makes headline pricing more informative than most buyers realize. When any custody offering is priced below what its own architecture costs to run, one of two things is true. The economics are subsidized to buy share, and subsidized economics end. Or the margin lives in an adjacent product the client is expected to buy next. A genuinely distributed custody model offered at single-custodian prices should prompt one question: what funds it?

A related quiet problem sits one layer down. Where coverage is optional rather than included, the lowest headline price often corresponds to no coverage at all, paired with published terms that disclaim provider liability for nearly everything that could go wrong. No policy, no recourse, no balance sheet behind the promise. The discount is the disclosure.

The deeper point is about time. Custody is a relationship measured in decades, and the provider’s survival is itself a security property. A sound custodian prices at the market-clearing level precisely so its security operations can scale with the balances it protects. It is also why one flat rate for an asset like bitcoin does not hold up at scale: the client services and security required to protect $1 billion and to protect $100 billion are not the same, and the fee has to scale in proportion, or the controls quietly fall behind the balances. A company that cannot fund its own cost stack will eventually raise prices on a captive client base, cut the controls the model depends on, or exit and force a migration nobody planned for. All three land on the client. Onramp has operated its model for four years, through a full market cycle, with over a billion dollars custodied and zero security incidents. In custody, durability is close to everything.

5. Removing the risk before pricing it

Onramp’s design goal from day one was to remove risk by architecture and insure only what remains.

In Multi-Institution Custody, keys live with three independent institutions. Clients hold no keys, so there is no seed phrase in the house, no device to exploit, no wrench with anything behind it. Every vault is segregated and client-titled, never pooled, never lent, never on the company’s balance sheet, so any incident’s blast radius is a single vault. Every movement requires two of three independent key agents, initiated by the client with video verification. No single institution, including Onramp, can move client bitcoin, and that constraint is enforced by the Bitcoin protocol rather than by policy. Every client can verify their own vault on-chain at any time.

The risks that cost 0.8% a year to insure elsewhere are, in this architecture, largely gone before an underwriter picks up a pen. What remains is genuine tail risk, which is what insurance is actually for.

6. Building the policy

Insuring this model was itself a first. When Onramp and Native, our regulated insurance broker, brought Multi-Institution Custody to Lloyd’s of London, underwriters had never seen a multi-redundancy custody setup in practice. Traditional frameworks had no category for consensus-driven authorization across regulated entities. The category had to be built.

The design brief had three requirements. The insurance had to complement the architecture rather than duplicate it, because paying to cover risks the model already mitigates is how premiums become prohibitive. Coverage had to be structurable at the level of each client’s vault rather than as a pooled abstraction. And the price had to be low enough to include in the standard service, which ruled out broad, untargeted coverage from the start.

The solution was to isolate the risks. The architecture already addresses the technical failure modes, so the policy was scoped to the residual institutional factor no key ceremony can design away: collusion among the institutions in the quorum itself. Coverage is conditioned on Onramp's declared security controls. Narrower scope, honestly drawn, is what made the economics work.

Then Lloyd’s did something no marketing budget can buy. Before quoting terms, underwriters conducted an extensive examination of the custody architecture itself. They verified that no single custodian could unilaterally access client assets, assessed the consensus mechanisms across the regulated entities, evaluated permission structures and authorization workflows, and analyzed potential collusion scenarios and their likelihood. Canopius re-underwrites the model annually and has priced it accordingly.

That process is the story. The world’s most established insurance market only underwrites custody architectures it considers low-risk, which is why single-custodian models rarely qualify for comparable coverage. Canopius re-underwrites this model every year as a condition of coverage. An independent auditor examines our controls under SOC 2, Type I complete, Type II observation underway. We operate as a FinCEN-registered money services business with a BSA/AML program under independent review.

Behind the custody policy sits a full corporate insurance program: crime coverage written specifically for digital assets, including employee theft, social engineering, and funds-transfer fraud; cyber and technology errors and omissions coverage, including digital-asset-specific perils; and professional and management liability with digital-asset endorsements. Layers, not limits. In models where the client is a keyholder, client operational error is the client’s problem and frequently a claim-killer. In ours, professional and operational liability sits with the institution, and it is separately insured.

7. What the structure delivers

Onramp maintains digital asset custody insurance through Canopius, a Lloyd’s of London syndicate: a $100 million facility with a $50 million active aggregate limit covering Onramp’s custody operations, at no cost to clients. The policy carries no deductible. Because coverage is conditioned on Onramp’s declared security controls, a claim examines our operation, never a client’s personal key handling.

The structure is two-tiered by design. Base coverage rides with the custody operation, included for every client. For clients who want a policy with their own name on it, individually named coverage with a dedicated, ring-fenced limit is available at pre-agreed rates through Native, without becoming a keyholder to get it.

Most people, shown all three columns, take the middle one, because the architecture already did the work the left column charges for. Some take the right, and it’s there for them. Almost nobody chooses to pay close to 1% a year to hold the risks themselves.

8. Addressing the objections

“I want my name on the policy.” A legitimate preference, and we accommodate it through Native at pre-agreed rates, with no deductible and no keyholder requirement. What we’d push back on is the premise that a named policy is the strongest form of protection. The strongest form is an architecture in which the loss the policy covers cannot easily occur. The policy is the backstop, and in the best-designed systems it stays that way.

“Why does multi-institution pricing sit above some alternatives?” Because three institutions share in the economics, and each has to be paid for the risk it stands behind. An alternative priced below that level is funded somewhere else: by an adjacent revenue line, by premiums the client is expected to add later, or by outside capital with a finite runway. The question to ask any provider is not what custody costs. It is what funds the price.

“Cheap custody works fine.” Custody priced below its cost is either subsidized or monetized elsewhere. Neither is a security model.

9. Where the industry goes from here

Insuring Multi-Institution Custody produced lessons that extend past one policy. Insurers understand and value the combination of technical security with legal and institutional protections; neither alone commands the best terms. Base coverage included for everyone, with optional higher limits above it, lets clients choose their own risk appetite instead of inheriting one. And the deepest principle is the one Lloyd’s validated with its pricing: better design earns better rates. That principle will drive a generation of custody systems engineered for insurability, and it moves the industry past the individual policy toward collaborative models built on distributed custody’s strengths. Removing the cost barrier between serious holders and properly insured custody is how adoption actually happens.

10. Why Onramp

We took the elegant path: remove the risk by architecture, insure the tail at the company level, and hand the client protection they never get billed for. Scale did the rest, compressing the cost of Multi-Institution Custody to flat monthly pricing within each tier, stepping up as the relationship grows. It currently starts at $100 a month for clients under five bitcoin; a decade of standalone premiums would exceed that figure within the first year.

What somebody wants and what they’ll pay for are two different things, and the companies that last close that gap with engineering instead of a premium. Four years of operation, over a billion dollars custodied, and zero security incidents say the market understands the difference.