Can You Write Off Crypto Lost to Hacks, Theft, or Scams?

Your wallet now shows zero. “Support” had you approve one more transaction. Your thoughts are starting to spiral as you realize your worst-case scenario has come true and your wallet has been drained.

Can you write off crypto lost to hacks, theft, or scams? For a personal hack, usually no. For a fake investment you thought was real, maybe, if you can prove a theft and you have no recovery left. 

TokenTax timestamps what you paid, so the basis on that drained lot is the same number a later sale would use.

Publication 547 still treats most personal casualty and theft losses as nondeductible unless they are tied to a declared disaster. Public Law 119-21 made that limit permanent for years after 2017 and added certain state-declared disasters starting in 2026. For example: a phishing drain is not a hurricane, and lost keys are not a flood.

A price drop you have not closed is not a write-off either. You realize a capital loss when you sell, swap, or spend. See how to report crypto losses for that path. The table below gives an overview of the tax paths.

Short answer: not if the coins were personal-use property. Yes, possibly if you held them as an investment or the scam was a deal you entered into for profit, and you can prove theft.

Topic 515 says two things at once. Personal theft is allowed only when it is tied to a federally declared disaster, or, starting in 2026, a state-declared one. Theft incurred in a trade or business, or in a transaction entered into for profit, can still be deducted.

CCA 202511015 walks through scam facts. Romance and kidnapping scams failed because there was no profit motive. Fake-investment and “move your money to protect it” facts passed when the victim was trying to keep or grow an investment. The year of the loss is the year you discover the theft, and it becomes reasonably certain you will not get the coins back. The amount is basis, not the high-water mark.

Stolen coins or NFTs

If the NFT or coin was investment property and the taking is theft under the law where it happened, the deduction is your adjusted basis minus insurance, exchange credits, and any recovery you still reasonably expect. File in the discovery year. Attach the hashes, the police or IC3 report, and the worksheet that shows how you got to basis.

Worthless coins

A chart that went to zero is not a closed transaction. If the token still trades, sell it, even for a few cents, and take the capital loss. If there is no market at all, you still need an identifiable event. Do not treat crypto as a worthless security under section 165(g) unless it actually is a security. Most tokens are not.

Recording hacks and scams for tax purposes

• Date and time of the drain, plus the USD value you paid for each lot (basis), not only the price that day

• Wallet addresses, transaction hashes, and which coins or NFTs left

• Screenshots of the phishing site, fake app, or chat that got you to sign

• Police report, IC3 complaint number, and any platform ticket

• Insurance, exchange reimbursement, or restitution, including claims you have not been paid on yet

• Tag the lots in your tax software so a later recovery or leftover sale does not go out as $0 basis

A deduction sticks only when all of this is true:

• Profit-seeking deal. You thought you were investing, trading, or moving funds to protect an investment. A romance transfer or a fake kidnapping payment is personal.

• Theft under state law. Swindling and false pretenses count. Revenue Ruling 2009-9 says theft includes that kind of taking. You still have to match the crime where you live.

• No reasonable prospect of recovery. A live insurance claim, an exchange investigation that still might pay, or a freeze that could reverse the tx means you wait. Deduct when recovery is no longer a real prospect.

• You discovered it this year. Section 165(e) treats a theft loss in the year you discover it, not the year the coins were taken, if those years differ.

Can you deduct crypto lost due to lost wallet access?

No. Nobody stole the coins, because you cannot move them. That is not theft, and it is not a declared disaster, federal or state. Hardware that failed over time is not a sudden casualty either. Keep the addresses, as people do recover old seeds years later. Claiming a loss and then finding the phrase is a mess you do not want.

If the theft qualifies, the deduction is your adjusted basis minus reimbursements and any recovery you still reasonably expect. You do not deduct the gain you never reported. FMV on the day of the hack is the wrong number. The loss also covers fake fees the scammer talked you into paying: phony taxes, withdrawal penalties, security deposits. CCA 202511015 says those count.

Example. You bought 4 ETH in 2024 for $10,000. In December 2026, a phishing site drains the wallet. ETH is $3,200 that afternoon, so the stolen stack is worth $12,800. The exchange later credits $2,000. You have no other claim that looks likely to pay. If this is a qualifying profit-seeking theft, the loss is $10,000 − $2,000 = $8,000. Not $12,800. If the exchange sends another $1,000 in 2027, that $1,000 is income in 2027.

Report a qualifying theft on Form 4684. Income-producing property goes in Section B, then to Schedule A or Form 4797 as the instructions say. A sale of coins you still hold is a different form: Form 8949 and Schedule D.

Rev. Proc. 2009-20, as modified by Rev. Proc. 2011-58, allows a qualified investor to deduct 95% of the qualified investment in the discovery year, or 75% if the investor is pursuing third-party recovery, then subtract actual recoveries and insurance or SIPC-type claims. Discovery year is the year a lead figure is charged, or when a complaint plus a freeze or a receiver is filed.

Most crypto scams fail that test. In CCA 202511015, the pig-butchering scheme arguably fit the description of a specified fraudulent arrangement, but the safe harbor still failed because no one had been charged. You then use the ordinary theft rules, or you have no deduction.

Reporting Ponzi scheme losses

If you meet the safe harbor, compute qualified investment, apply 95% or 75%, subtract recoveries, and claim the result as a theft loss on Form 4684. Attach the statement in the revenue procedure. Keep the indictment, the receiver papers, and every cash-in and cash-out record. Using the harbor means you accept the percentage. You also do not take a larger loss in the same year under the general rules.

• Pig butchering. Fake relationship, fake platform, real deposits. Often a profit-seeking theft if you can prove it. Rarely a Ponzi safe harbor.

• Account takeover. SIM swap or stolen seed, then a drain of an investment wallet. Theft of investment property if the facts hold. Reduce by any exchange reimbursement.

• Fake investment site. Deposits in, withdrawals blocked. Treat as theft if state law agrees. Check whether a named operator has been charged before you reach for Rev. Proc. 2009-20.

• Romance scam. Personal. No §165(c)(2) profit motive on those facts in CCA 202511015. No personal casualty deduction either.

• Rug pull. If the token still trades, sell it for a capital loss. Theft only if someone actually stole under local law, not just dumped liquidity.

• Giveaway or recovery scam. The second hit. Report it. Do not pay anyone who claims they can reverse the first theft. The IRS will not treat that fee as a cleaner path to a deduction.

1. Move whatever is left off the compromised wallet or exchange. Rotate passwords and keys.

2. Export CSVs, take a screenshot of the drain, and copy the hashes and destination addresses.

3. Open a ticket with the platform. Ask in writing whether any reimbursement is possible.

4. File a local police report and an IC3 complaint. Add an FTC report.

5. Ignore anyone who says they can recover the coins for a fee. That is the second scam.

6. Rebuild the lots. TokenTax keeps the original basis attached so you are not guessing at filing time.

1. Sort the facts: personal casualty, profit-seeking theft, or a sale of whatever you still hold.

2. If you sold remaining tokens at a loss, report each disposal on Form 8949 and Schedule D. That is the clean path for rug pulls that still trade.

3. If you have a qualifying profit-seeking theft, complete Form 4684 for the discovery year. Section B is for business and income-producing property. Reduce basis by reimbursements.

4. If a named Ponzi lead figure was charged and you elect the safe harbor, use the Form 4684 Ponzi section and attach the required statement.

5. Answer the digital asset question on Form 1040. A drain is a disposition.

6. If you recover coins or cash after deducting the loss, treat that amount as income in the recovery year.