Lost or Stolen Crypto: Casualty/Theft Loss Treatment Post-TCJA — Why You Probably Can’t Deduct It (and What to Do Instead)

TCJA killed the casualty and theft loss deduction — permanently

Before the Tax Cuts and Jobs Act of 2017, individuals could deduct theft and casualty losses under IRC § 165(c)(3) as an itemized deduction on Schedule A. If someone hacked your exchange account and drained your crypto, the loss was deductible (subject to a $100 floor and a 10%-of-AGI threshold).

TCJA changed that. Section 165(h)(5) suspended personal casualty and theft loss deductions for tax years 2018 through 2025. The only exception: losses attributable to a federally declared disaster under IRC § 165(i). A crypto hack, a rug pull, a lost seed phrase — none of these qualify as a federally declared disaster.

The part most people miss: OBBBA (the One Big Beautiful Bill Act) extended the TCJA individual provisions permanently. The casualty/theft loss suspension isn’t expiring. If you’re waiting for 2026 to “bring back” the theft loss deduction, it’s not coming.

Lost keys vs. stolen crypto vs. exchange collapse: three different problems

These get lumped together, but they have different factual patterns — and different strengths under the capital loss argument.

The capital loss workaround: treating lost crypto as disposed of for $0

Since the casualty/theft loss path is closed, practitioners have gravitated toward capital loss treatment under IRC § 165(a) and (f). The theory: if crypto is permanently lost, stolen, or worthless, you’ve effectively disposed of a capital asset for $0 proceeds. The loss equals your cost basis.

How it works on Form 8949:

• Description: “2.5 ETH — stolen from MetaMask wallet” or “0.8 BTC — lost private key, permanently inaccessible”
• Date acquired: your original purchase or receipt date
• Date sold: the date you determined the crypto was permanently lost or stolen
• Proceeds: $0
• Cost basis: your original purchase price (or FMV at receipt for forked/airdropped tokens)
• Loss: the full cost basis

Long-term capital losses (held over 12 months) offset long-term capital gains first, then short-term gains. Up to $3,000 of net capital losses can offset ordinary income per year, with unlimited carryforward to future years.

Worked example: stolen ETH from a DeFi exploit

Numbers use 2026 federal brackets from IRS Rev. Proc. 2025-32.

The setup

A single filer in Chicago bought 12 ETH across three transactions in 2021–2022 for a total cost of $36,000 ($3,000 average basis per ETH). In January 2026, a smart-contract exploit on a DeFi lending protocol drains 8 of those 12 ETH from the pool where she had deposited them. The tokens are gone — transferred to an unidentified wallet and bridged off-chain. She still holds 4 ETH in a hardware wallet. Her W-2 income in 2026 is $95,000.

The capital loss calculation

Tax impact in 2026

Suppose she also sold some stock for a $10,000 long-term capital gain during 2026. The $24,000 long-term loss offsets the $10,000 gain entirely ($0 net LTCG), and an additional $3,000 offsets ordinary income. Remaining carryforward: $11,000 — which she can use in future years.

At her $95,000 W-2 income, the $3,000 ordinary-income offset saves her roughly $660 in federal tax (22% bracket). The $10,000 gain offset saves $1,500 (15% LTCG rate for single filers with taxable income between $48,351 and $533,400). Total 2026 tax savings: approximately $2,160, with $11,000 of losses carrying forward.

The cost-basis method matters here. Under FIFO, the oldest (likely lowest-basis) lots are treated as stolen first. If she used specific identification and could designate the highest-basis lots as the ones lost, the loss would be larger. But specific identification requires contemporaneous records designating which lots were deposited into the DeFi protocol — records most people don’t keep.

The IRS guidance gap: what exists and what doesn’t

The bottom line: there is no published IRS guidance specifically addressing the tax treatment of lost or stolen cryptocurrency. Practitioners are applying general property-loss rules by analogy. The capital loss position is reasonable and widely used, but it has not been tested in court or confirmed by the IRS in a ruling, notice, or revenue procedure.

Documentation: the single thing that protects you

Without specific IRS guidance, your documentation is your defense. Build a file that includes:

• Proof of ownership and cost basis: exchange confirmations, on-chain transaction hashes showing your original purchases, transfer records to the wallet or platform where the loss occurred
• Evidence of the loss event: screenshots of the exploit announcement, exchange bankruptcy filings, police report (file one even if recovery is unlikely — it establishes contemporaneous evidence), blockchain explorer showing the outbound theft transaction
• Recovery attempts: correspondence with exchanges, law enforcement, or recovery services. Document what you tried and why recovery failed.
• Written statement of irrecoverability: a contemporaneous memo (dated) explaining why you believe the crypto is permanently lost. For lost keys: note the wallet address, the on-chain balance, the failed recovery methods. For theft: note the theft transaction, the destination wallet, law enforcement contact.
• FMV at the date of loss: the market value of the stolen/lost crypto on the date you determined it was gone. You don’t need this for the loss calculation (proceeds are $0 regardless), but it establishes the economic magnitude for context.

Exchange bankruptcy: the strongest case for capital loss

When a centralized exchange collapses, bankruptcy proceedings create exactly the kind of documentation the IRS would want to see. The exchange has filed a petition under Chapter 11 or Chapter 7. A court has appointed a trustee. Your balance is frozen. Distribution to creditors is uncertain, partial, or zero.

Timing matters: you generally shouldn’t claim the full loss in the year the exchange suspends withdrawals. Wait until bankruptcy proceedings establish that your recovery will be zero or a fixed partial amount. If you receive a distribution in a later year, that distribution is income (or a reduction in your loss carryforward).

Partial recovery: if a bankruptcy estate distributes $0.30 on the dollar, your capital loss is your cost basis minus the distribution received. On a $50,000 deposit with a $15,000 distribution, your capital loss is $35,000.

Lost seed phrases: the hardest case

This is where the tax treatment gets genuinely uncertain. You still own the crypto. It’s sitting on-chain at a known address with a known market value. You simply cannot access it.

Two competing arguments:

• Worthless to you: the asset has zero economic value to you because you can never sell, spend, or transfer it. Under IRC § 165(a), a loss is allowed for “any loss sustained during the taxable year and not compensated for by insurance or otherwise.” A permanently inaccessible asset is a sustained loss.
• Not disposed of: the IRS could argue that no sale, exchange, or other disposition occurred. You haven’t transferred the crypto to anyone. It’s not worthless on the open market — just inaccessible to you specifically. No disposition, no capital loss.

Before claiming this loss: exhaust recovery options first. Professional crypto recovery services can sometimes reconstruct seed phrases from partial information, recover data from damaged hardware wallets, or identify alternative access paths. If recovery is genuinely impossible, document why: the hardware wallet was destroyed, no partial seed phrase exists, multiple professional recovery attempts failed.

Recovery service scam warning: the crypto recovery industry is rife with fraud. Legitimate recovery firms (like Wallet Recovery Services or KeychainX) charge flat fees or hourly rates. Any service that asks for upfront crypto payments, requests your remaining seed words, or guarantees recovery is almost certainly a scam. A second theft on top of the first doesn’t improve your tax position.

Cost-basis methods matter for loss calculations

If only part of your crypto holdings were stolen (you held 12 ETH and 8 were taken), the cost-basis method determines which lots make up the loss.

Practical problem: specific identification requires you to have designated which lots were deposited into the compromised wallet or DeFi protocol at the time of deposit. If you moved “some ETH” to a hot wallet without tracking lot-level detail, FIFO is your default — and likely produces the smaller loss.

The wash-sale exemption: a silver lining on crypto losses

IRC § 1091 disallows losses on sales of “stock or securities” if you repurchase substantially identical assets within 30 days. Crypto is classified as property under Notice 2014-21, not stock or securities. The wash-sale rule does not apply to crypto as of 2026.

What this means for theft and loss scenarios: if your stolen ETH creates a capital loss and you want to maintain ETH exposure, you can immediately buy replacement ETH with no impact on the loss deduction. No 30-day waiting period. No substantially-identical-asset analysis.

This is especially relevant for exchange-bankruptcy situations where you receive a partial distribution months or years later. You can use that distribution to repurchase the same token immediately, claim the loss on the unrecovered portion, and re-establish your position — all in the same transaction.

Staking and DeFi income on crypto that was later stolen

If you earned staking rewards or DeFi yield on crypto that was subsequently stolen, those income events still stand. Staking rewards are ordinary income at FMV when received (per IRS guidance and the framework in Jarrett v. United States). You reported that income, and the theft doesn’t reverse it.

However, the basis of those staking rewards equals the FMV you reported as income. If 0.5 ETH of staking rewards was reported as $1,500 of income and then stolen, your capital loss on that 0.5 ETH is $1,500 — partially offsetting the income you already paid tax on. Partial recovery through the loss deduction, not a full wash.

Form 8949 and Schedule D: reporting mechanics

Reporting the loss

• Use Form 8949, Part II (long-term) if you held the crypto for more than 12 months, or Part I (short-term) if 12 months or less
• Description: “8 ETH — stolen via DeFi exploit, [date]”
• Date acquired: original purchase date
• Date sold: date of theft or date you determined the loss was permanent
• Proceeds: $0
• Cost basis: your original purchase price
• Totals flow to Schedule D

The Form 1040 digital-asset question

The front page of Form 1040 asks whether you received, sold, exchanged, or otherwise disposed of any digital assets. If your crypto was stolen or you’re claiming a loss on inaccessible crypto, the answer is yes — you’re reporting a disposition.

Capital loss limits

Net capital losses offset ordinary income up to $3,000 per year ($1,500 if married filing separately). Excess losses carry forward indefinitely. A $24,000 capital loss from stolen crypto takes 8 years to fully absorb if you have no capital gains to offset it against. This is one reason tax-loss harvesting across the rest of your portfolio matters in the year of a theft — harvesting gains to offset against the theft loss accelerates the tax benefit.

What not to do

• Don’t claim a casualty or theft loss on Schedule A. TCJA suspended it; OBBBA made it permanent. The IRS will disallow it.
• Don’t use the loss to offset more than $3,000 of ordinary income per year. The capital loss limit is statutory. You can’t deduct $24,000 against your W-2 in one year.
• Don’t claim the loss without documentation. “My crypto was stolen” without a police report, on-chain evidence, or exchange correspondence is an audit flag.
• Don’t double-count. If you reported the original purchase as a cost basis and later received a partial bankruptcy distribution, your loss is the basis minus the distribution — not the full basis.
• Don’t claim a loss on crypto you might still recover. If there’s a realistic chance of recovery (ongoing bankruptcy with expected distributions, active law-enforcement investigation with frozen funds), the loss isn’t established yet.

The bottom line

The casualty/theft loss deduction for lost or stolen crypto is dead — TCJA killed it, and OBBBA buried it. The capital loss route via Form 8949 is the viable alternative, but it comes with a $3,000 annual limit against ordinary income and requires you to establish that the crypto is permanently worthless or irrecoverable. Exchange bankruptcy provides the cleanest documentation. Theft with on-chain evidence is solid. Lost private keys are the gray area where the IRS hasn’t drawn a line.

Document everything. File a police report even if recovery seems unlikely. Use a CPA with digital-asset experience to navigate the reporting — the intersection of IRC § 165, capital loss rules, and crypto-specific guidance gaps is exactly the kind of area where a generalist preparer misses the deduction entirely or takes a position the IRS will challenge.