Tax code brings a silver lining to being hacked
A hack or a scam can empty a wallet in seconds. When the coins were held as an investment, the tax code sometimes lets you write off the loss. Here is who still qualifies and what you need to prove it.
Large exchange breaches get the headlines. About 850,000 bitcoin vanished when Mt. Gox failed in 2014. Hackers pulled roughly $500 million out of Coincheck in 2018. The numbers have only climbed since, and exchanges are not the only target. Individual wallets get drained every day through phishing pages, fake token approvals, SIM swaps, and malware that watches the clipboard.
If it happens to you, the money is usually gone for good. Stolen crypto is hard to trace and harder to claw back. The one place you may recover part of the hit is your tax return. The rules changed after 2017, though, so the old advice about theft losses no longer fits every case.
How the coins get taken
Most thefts trace back to one thing: someone else could reach the private key. If you leave coins on an exchange, the exchange holds that key. That is convenient, and it is also why exchanges are worth attacking. When Coincheck was hit, its customers had no control over the keys that protected their balances.
Moving funds into a wallet whose keys you hold yourself removes that single point of failure, but it moves the responsibility to you. A key sitting in a file, a screenshot, or a browser extension can be copied by malware or handed over on a convincing fake site. Cold storage, meaning a hardware wallet or an offline signer that never exposes the key to an internet-connected machine, closes most of that gap. So does reading what you sign. Many recent drains come from token-approval prompts that quietly grant a contract permission to move everything in the wallet.
None of this is about blame. Careful people still get hit. It matters for taxes because the way a loss happened decides how, or whether, you can deduct it.
When a stolen-coin deduction still works
Section 165 of the tax code lets individuals deduct three kinds of losses: those from a business, those from a transaction entered into for profit, and casualty or theft of personal property. Crypto held as an investment lands in the middle category, and that distinction is the whole ballgame after 2017.
The 2017 tax law suspended the personal casualty and theft loss deduction for tax years 2018 through 2025, with an exception only for losses from a federally declared disaster. Congress has kept that personal-use limit narrow since. So if the stolen crypto was purely personal, a straight theft-loss write-off is off the table for those years.
A theft of property you held for profit is a separate provision, and the 2017 suspension did not touch it. Because most people buy crypto hoping it appreciates, a theft from an investment wallet, or a scam that took investment funds, can still support a deduction. It goes on Form 4684, it counts as an ordinary loss rather than a capital loss, and it is not one of the miscellaneous itemized deductions that were shut off after 2017. It also escapes the 10% of adjusted gross income floor and the $100 reduction that apply to personal casualty losses.
Three conditions do the gatekeeping:
- It has to be a theft under the law where it happened. Criminal intent is the test, so fraud, swindling, and false pretenses qualify. A price crash does not, and neither does misplacing your own keys.
- There can be no reasonable prospect of recovery in the year you claim it. An open insurance claim, an exchange reimbursement, or a bankruptcy estate that might pay out (the Mt. Gox and FTX estates are recent examples) can push the deduction to a later year or shrink it.
- You have to prove it: that a theft occurred, the amount, and your cost basis in the coins. Bring records.
One practical catch the old rules already flagged: this is an itemized deduction. If you take the standard deduction, the theft loss may produce no benefit at all.
Losses that are not theft
Plenty of crypto losses feel like theft but get treated as something else, usually a capital loss. If you sell or otherwise dispose of a coin for less than you paid, that is a capital loss. It offsets your capital gains first, then up to $3,000 of ordinary income a year, with the rest carried forward to future years.
A token that simply goes to zero is harder. A drop in value while you still hold the coin is not deductible, and "worthless" has to mean genuinely worthless, with no market and no chance of recovery, before you can claim it. A failed or fraudulent initial coin offering sits right on the line. If you were the victim of an actual theft in a profit-seeking deal, the Section 165 theft rules may reach it. If the token merely flopped for ordinary reasons, you are back to a capital loss capped at $3,000 a year against ordinary income. For losses from a fraudulent investment scheme, the IRS also offers an optional safe harbor (Revenue Procedure 2009-20) that sets a fixed percentage and eases part of the proof burden.
Theft versus capital loss, personal versus for-profit, and the right year to claim it are where these go sideways. We will match you with a pro who sorts it before you file.
Get matched with a crypto-tax pro →If it happens to you
- Report it. File with the FBI's IC3 and your local police, and open a ticket with any exchange involved. A report backs up the theft claim and starts any recovery process.
- Preserve the evidence. Transaction hashes, wallet addresses, dates, exchange correspondence, and the police report number are what a preparer works from.
- Pin down your basis. What you paid, and when, sets the size of any deduction. Reconstruct it now while the records are still reachable.
- Check for recovery. If an insurer, exchange, or estate might pay you back, that affects which year you can claim and how much.
- Get the category right before you file. Theft or capital loss, personal or for-profit, and the timing are exactly where these returns go wrong.
The deduction will not make you whole. At best it offsets part of the loss against your other income. But leaving it on the table, or claiming it the wrong way, both cost money, and figuring out which path applies is worth a careful look.