A crypto theft loss is the loss of cryptoassets taken from you through a criminal act such as a hacked exchange account, a drained wallet, a phishing signature or a fraudulent investment scheme. It is distinct from a loss caused by a fall in price, a failed project or a platform insolvency, where nothing was stolen.
Most crypto thefts follow a few patterns. A private key or seed phrase is compromised and the wallet is emptied. A token approval or a signed message hands a contract the right to move assets, and it does. An exchange is hacked and customer balances are taken. An investment scheme takes deposits it never intended to return. In each case the assets leave through a real on-chain transaction, and the chain records it as an ordinary transfer to another address.
What separates these from other losses is that someone took the property. A token that fell to zero, a project that failed, or an exchange that went bankrupt while still holding your assets are losses too, but nothing was stolen, and they are analysed under different rules.
A trader signs a transaction on a fake airdrop site that grants unlimited approval over their USDC, and the balance is swept minutes later. An investor sends ETH to a platform that reports fictitious profits and then stops paying withdrawals, which is the Ponzi scheme loss pattern. An exchange account is taken over through a SIM swap and its contents withdrawn. A crypto rug pull can be a theft if the developers appropriated investor funds, and something else entirely if the project simply failed.
Stolen crypto is deductible only when four conditions line up, and none of them is met by default.
First, there must be a theft. Under Treasury Regulations section 1.165-8, theft includes larceny, embezzlement and robbery, and whether one occurred is decided under the law of the state or country where it happened. A loss caused by a bad decision, a market fall or a counterparty insolvency is not a theft. Second, the loss must fall within IRC Section 165(c). For an individual that means either Section 165(c)(2), a loss in a transaction entered into for profit, or Section 165(c)(3), a personal casualty or theft loss. The distinction matters because Section 165(h)(5) allows personal casualty and theft losses for tax years beginning after 2017 only to the extent they are attributable to a federally declared disaster. A loss under Section 165(c)(2), an investment theft loss, is outside that limitation.
Third, timing. Section 165(e) treats a theft loss as sustained in the year the taxpayer discovers it, the discovery year, not the year the assets left. Fourth, if there is a claim for reimbursement with a reasonable prospect of recovery, the part of the loss that claim covers is not sustained until the outcome is known with reasonable certainty.
When all four are satisfied, the deductible amount is the lesser of the adjusted basis in the stolen assets and their fair market value immediately before the theft. Appreciation that was never taxed is not deductible, so a coin bought for $2,000 and stolen when worth $50,000 gives a $2,000 loss. The loss is reported on Form 4684, Section B, as a loss on income-producing property, and carried to Schedule A as an itemized deduction. It is a theft loss, not a capital loss, and it is not the same as the Ponzi scheme safe harbor, which is a separate optional method for one category of theft.
Basis is the figure that goes missing. The deduction is capped at adjusted basis, so a stolen wallet full of coins acquired years earlier on exchanges that no longer exist has no provable basis and, on paper, no deductible loss. Tax software usually records the outgoing transaction as a transfer to an unknown wallet, which leaves the basis attached to a balance you no longer hold and reports nothing. Reconstructing the acquisition history of every stolen unit is what turns the theft into a supportable figure.
Read our 2026 Guide to Claiming Crypto Losses from Fraud, Scams, Theft
CountDeFi specializes in fraud, hack and theft loss accounting, including wallet drains, exchange hacks and cost basis reconstruction for stolen assets. See pricing.
