Roberta Anderson Sutton was featured in Law360's coverage of the $6.3 billion theft of crypto assets from Binance, a loss the FBI has attributed to a North Korea-backed group, and one that insurance industry commentators say may be uninsurable. Roberta offers a policyholder's perspective on the three questions the hack raises: scale, the war exclusion, and the social engineering sublimit.
On scale, Roberta explains that companies facing a significant loss cannot afford to view their cyber losses through the narrow lens of a stand-alone policy: "You literally could stack every crypto specie, crime and cyber tower in London and in the domestic market end-to-end, and it would still represent a drop in the ocean against this 10-figure loss."
On the war exclusion, she pushes back on the assumption that a state-attributed attack is automatically excluded, noting that North Korean hacking groups are a known threat insurers already price into their premiums: "Uninsurable and unpriceable aren't the same as excluded. The war exclusion exists because insurers can't rate the peril, but they rate North Korean theft every day."
And on the fake-job-interview intrusion that gave the hackers access, she rejects the insurer playbook of relabeling the loss as "social engineering" to shrink it to a sublimit: "When an attacker introduces malicious code and executes unauthorized automated script, this is classic computer fraud, no employee voluntarily transfers any money like this $6.3 billion."
Read the full article: Binance Mega-Hack Confirms Cyberinsurance Industry Fears (Law360, November 5, 2026)
