What if the insurance company claims Coinbase and Circle were negligent and refuse to pay if they are hacked? I personally know people whose insurance companies refused to pay for car accidents until taken to court over it. Most insurance comes with a massive list of get out clauses which the insurance companies can use to avoid paying out claims.