The discovery year is the year in which a taxpayer discovers that property has been stolen. For a hacked wallet it is usually the year of the hack. For a fraud it is the year the fraud comes to light, which can be years after the money was handed over.
A wallet drain is discovered when the owner opens the wallet, so the discovery year and the year of the theft are almost always the same. Fraud is different. A platform can keep paying withdrawals and publishing fabricated balances for years. Investors discover the theft only when withdrawals stop, an exchange freezes, regulators act or a founder is charged. By then the deposits may span several years, and none of them was known to be stolen when made.
The discovery year is a single year for a single theft. Deposits made in 2021, 2022 and 2023 to a platform exposed in 2024 have one discovery year, 2024, and the whole loss is measured and reported there, subject to any recovery claims.
IRC Section 165(e) provides that a loss arising from theft is treated as sustained in the taxable year in which the taxpayer discovers the loss. Treasury Regulations section 1.165-8 restates the rule and adds the qualification that where a claim for reimbursement with a reasonable prospect of recovery exists in the discovery year, the part of the loss that claim covers is not sustained until the reimbursement question is settled. The year of the theft itself is irrelevant to timing. A crypto theft loss from a 2022 hack discovered in 2025 belongs on the 2025 return.
Discovery means learning that a theft has occurred, not learning every detail of it. Once an investor knows the platform was fraudulent and the funds are gone, the year has been fixed even if the perpetrator has not been identified and the amount recoverable is unknown. The amount and the recovery prospects are separate questions.
The Ponzi scheme safe harbor in Revenue Procedure 2009-20 replaces this factual test with a mechanical one for losses it covers. Under the safe harbor the discovery year is the year in which the indictment, information or criminal complaint against the scheme's lead figure is filed. That can be later than the year the investor personally realised the money was gone, and a taxpayer who elects the safe harbor uses the safe harbor's year.
The discovery year also fixes the return on which Form 4684 is filed and the year against which the deduction is applied. A theft loss under Section 165(c)(2) that exceeds income in the discovery year can contribute to a net operating loss under Section 172, so the year chosen affects more than one return.
Software dates the loss to the transaction, not the discovery. Deposits sent to a fraudulent platform in 2022 sit in the 2022 ledger as transfers out, and a report built from the ledger either shows them as still held on the platform or writes them off in 2022. Neither is right. The discovery-year return needs a loss figure built from transactions recorded in earlier years, with the basis of each deposit traced back to its original acquisition, and the earlier years left as they were filed.
Read our 2026 Guide to Claiming Crypto Losses from Fraud, Scams, Theft
CountDeFi specializes in fraud, hack and theft loss accounting, including multi-year fraud timelines, discovery-year loss schedules and cost basis tracing. See pricing.
