From a single funding pool to layered underwriting, who will bear the first loss.

Written by: @blocmates

Translated by: AididiaoJP, Foresight News

Interest in solving insurance problems in the cryptocurrency field has long been insufficient, which is evident from the typical responses the industry faces when confronted with tricky issues. Insurance can be said to be the most important element in current cryptocurrency, and the industry urgently needs new metrics to prove significant progress from the current situation.

Let’s recall, when was the last time there was no news of protocol treasury hacks in the cryptocurrency field for two consecutive months—never.

DeFi protocols and various smart contracts remain vulnerable to attacks, and trust is slowly eroding.

Between January and May 2026 alone, there were over 50 incidents, with total losses exceeding $840 million, a 70% increase compared to the same period in 2025. If we look at the most recent figures, this number has surpassed $2.68 billion.

The problem is clear: the existing security infrastructure of on-chain financial systems is weak, leaving users in a vulnerable state. However, hacker incidents themselves have become less newsworthy; the industry seems to have normalized them. What is truly worth noting is what happens afterwards.

What about insurance?

On April 18, attackers drained 116,500 rsETH, about $292 million, through the KelpDAO’s LayerZero bridge, marking one of the most significant DeFi attacks of this year.

These unbacked tokens were transferred to Aave as collateral, used to issue approximately $190 million in bad debts, triggering contagion.

In response, Aave froze the relevant markets, and TVL fell from over $26 billion to below $14 billion within days. Currently, Aave’s TVL is about $18.8 billion, showing that the situation is recovering.

Such attacks can affect multiple protocols and users; in the KelpDAO incident, at least 9 protocols were impacted.

Although rsETH has fully recovered, what really drew attention was the industry’s reaction after the attack.

Any traditional financial observer would immediately ask where the insurance is, only to find that the industry's response resembled a makeshift fundraising: protocols that happened to be too close to the fire supported each other—DeFi United, the coordinated rescue action led by Aave service providers after the aforementioned rsETH incident.

But this is not surprising. The cryptocurrency "insurance" industry has been shrinking. The total value locked in on-chain insurance protocols is currently $126 million, down from its historical peak of $1.9 billion in November 2021.

One reason for this contraction may be that many early on-chain insurance protocols were built on a single mutual aid model—a shared funding pool covering broad risks, with governance, underwriting, claims assessment, and capital management all tied to the same system.

This structure simplifies coordination but also centralizes exposure, turning the protocol itself into a single point of failure.

Capital providers bear the loss of the entire portfolio rather than clearly defined segmented losses, making it difficult to isolate tail events, accurately price exposure, or allocate capital with any precision; once a position blows up, everyone in the pool bleeds, regardless of what they initially thought they were underwriting.

In response, both established and new risk protection protocols have begun to draw lessons from traditional insurance, reinsurance, and structured finance.

The thought process starts from a sharper question: who bears the first loss? It then shifts to segmenting capital by risk characteristics, establishing dedicated pools or treasuries that allow providers to choose the exposure they truly want.

Protocol Protection Landscape

In traditional insurance, equity or specific reinsurance layers typically absorb initial losses. In early DeFi protection, the staking capital providers (underwriters) usually bear the first loss within a shared pool.

However, as previously mentioned, this is changing. Providers can now opt for more conservative safety layers, or higher yield, higher risk layers, while enhancing overall capital efficiency and capacity.

Here are some protocols in this category.

Nexus Mutual

Nexus Mutual remains an established protocol in the on-chain protection space, but has evolved into a more refined risk profiling system that allows it to provide layered protections.

The way it operates is that users purchase "cover" for specific protocols, custodians, yield tokens, or de-pegged assets.

Capital providers stake NXM (or a wrapped version) to underwrite; they earn premiums but bear the first loss during claims, which are assessed through member voting or structured processes.

Nexus’s risk products have expanded beyond pure smart contract risk to include custody, confiscation, and even hybrid products, such as crypto kidnapping and ransom insurance (co-responsible for response and ransom reimbursement with traditional partners).

Nexus Mutual currently allocates capital to over 70 specific protections rather than a single funding pool. Stakers bear the first loss, but diversification and efficiency tools reduce systemic pressure.

Nexus Mutual has also partnered with distributors like OpenCover to facilitate easier acquisition and packaging of products (for example, the "Base DeFi Pass" for multi-protocol protection on Base).

OpenCover

OpenCover acts as a distribution and structuring layer for on-chain insurance, simplifying the path to obtaining coverage across multiple underwriters, with most of the capacity currently provided by Nexus Mutual.

In addition to aggregation, the platform is developing new risk management products on top of the existing protection infrastructure.

Its flagship product Covered Vaults is launched in collaboration with Nexus Mutual, Morpho, Kiln, and Symbiotic.

Users can deposit into supported vaults and choose to activate coverage by staking vault shares, covering specific technical and economic loss events, all while not leaving the underlying strategy.

OpenCover's "Covered Vaults" approach shifts DeFi insurance from standalone policies to integrated, portfolio-level risk management.

Firelight Protocol

Another noteworthy protocol comes from the XRP ecosystem—Firelight.

Firelight directly addresses the question of who bears the first loss while advancing capital segmentation and borrowing concepts from traditional insurance and structured finance.

The protocol assigns the first loss bearers to stakers in the protection treasury. They bear the primary risk. Its capital directly supports payouts for effective claims, forming a benefit binding similar to traditional mutual or pooled underwriting models.

In terms of capital segmentation and specialized structures, Firelight uses dedicated non-custodial vaults and protection pools instead of a single funding pool.

This allows for more granular risk exposures and capital allocations, with staked assets (especially large-cap, low-correlation assets like XRP) specifically chosen to improve capital efficiency and resilience.

Built-in Protection

A few protocols take on the challenge of assuming underwriting risks, while most cryptocurrency or DeFi protocols adopt built-in approaches.

Platforms in this category integrate risk controls such as automatic stop-loss, liquidation buffers, and downside caps into the core mechanisms of leveraged tokens and yield vaults.

This shifts the burden of first-loss protection from external underwriters to the product architecture itself, allowing users to obtain higher yields while programmatically limiting tail exposure through rules.

Some examples

Gearbox Protocol provides credit accounts for leveraged farming and strategies, incorporating liquidation protection and isolated risk layers within each account.

Dolomite offers a money market with structured lending features and customizable risk parameters to limit excessive exposure.

Toros Finance provides leveraged tokens with embedded stop-loss logic and recovery mechanisms, capping losses without the need for manual intervention.

This integration draws on structured finance, designing protective measures directly into the tools themselves.

It reduces friction for users seeking protection from needing to purchase policies separately, while allowing protocols to more efficiently handle routine product-level risks than broad mutual assistance models.

Conclusion

In reality, the pace of development in on-chain risk protection economies still lags far behind the speed of attacks occurring.

The gap is significant, but these discussions are worth having. For on-chain insurance to progress, the industry needs to shed its obsession with on-chain total value locked (TVL) and instead focus on voices calling for more important metrics—total covered value (TVC).

Currently, the proportion of clearly covered value in DeFi locked value is less than 2%. To reignite trust in DeFi, TVC is a metric that needs attention, and the gap between locked and covered presents a huge opportunity for anyone who can adequately address the cryptocurrency insurance crisis.