Lost keys, hacks and scams: when a crypto loss counts for tax

A price crash, a lost key, a hack and a scam are four different tax events. The IRS and HMRC treat each one differently, and timing matters.

2026-10-17 · 6 min read

When crypto disappears, the book write-off and the tax deduction rarely line up. In the US, whether an individual can deduct a theft depends on the motive behind the transaction, and a token that has crashed is not treated as worthless while it still trades. In the UK, theft is not a disposal at all, and the route to a loss is usually a negligible value claim.

US: a crash is not a loss until something happens

In Chief Counsel Advice 202302011, released in January 2023, the IRS looked at an individual whose tokens fell from $1.00 to under one cent but still traded on at least one exchange [1]. The memo concluded there was no deductible loss under section 165: the tokens were not worthless because they still had value, and the holder had not abandoned them, since they kept control and could still sell [1]. A fall in value alone does not create a deduction; an identifiable event such as a sale, exchange or real abandonment is needed [1].

The memo added that even if a loss had existed, the individual could not have used it, because section 67(g) suspended miscellaneous itemized deductions [1]. That suspension was written for 2018 through 2025, but Public Law 119-21 removed the end date, so the provision (now section 67(h)) applies to all tax years beginning after 2017 [4]. For an individual holding near-worthless tokens, selling them is usually the cleanest way to fix the loss. Chief Counsel Advice cannot be cited as precedent [1].

US: theft and scams turn on profit motive

Chief Counsel Advice 202511015, released in March 2025, is the memo on scam victims [2]. It looked at five scams and treated all of them as theft under section 165, because the funds were taken illegally under state law [2]. A theft loss is taken in the year it is discovered, but not while there is still a reasonable prospect of recovery, and the deduction is limited to basis, not fair market value [2].

For individuals, the deciding question was motive. Victims who moved money to protect or reinvest it, including a cryptocurrency investment scam, had entered a transaction for profit under section 165(c)(2), and their losses were deductible [2]. Victims of a romance scam and a fake kidnapping had no profit motive, so their losses were personal casualty losses, which section 165(h)(5) disallowed [2]. The memo treats a hacked account like the phishing case, where the stolen property itself was held for investment [2]. None of the victims qualified for the Ponzi safe harbor in Rev. Proc. 2009-20 [2].

The memo described the personal casualty limit as running from 2018 through 2025 [2]. Public Law 119-21 has since removed that end date and added state-declared disasters alongside federally declared ones, so for later years the limit continues [3]. These section 165(c) limits apply to individuals [2]. A company that loses business assets to a hack faces a different analysis, which should be confirmed with a tax adviser.

UK: theft is not a disposal

HMRC's guidance for individuals says that losing a private key is not a disposal for capital gains tax, even though the tokens still exist on the ledger [5]. If you can show there is no prospect of recovering the key or the tokens, you can make a negligible value claim [5].

HMRC also says theft is not a disposal, because the victim still owns the tokens and has a right to recover them, so victims of theft cannot claim a capital gains tax loss [6]. If you paid for tokens and never received them, HMRC generally says there is no capital loss, because no asset was acquired [6]. If you did receive tokens that later became worthless, a negligible value claim may be possible, but not if they were worthless when you acquired them [6].

A negligible value claim under section 24 TCGA 1992 treats the tokens as sold and immediately bought back at the value stated in the claim, which can be nil [7]. The claim must state the asset, the amount and the date of the deemed disposal, and because tokens are pooled, it covers the whole Section 104 pool for that token [7]. All three HMRC pages were last updated on 28 November 2025 [5][6][7]. HMRC's company rules are not covered here.

What to do

• Classify each loss: price fall, lost key, unauthorized theft, or induced transfer.
• Record the date of discovery and every recovery step, such as police reports, exchange tickets and bounty offers.
• Keep basis records per wallet, since US theft losses are capped at basis.
• For crashed tokens, document a sale or abandonment rather than relying on a low price.
• For UK individuals, prepare negligible value claims with the pool, amount and date.
• Get tax advice before claiming, especially for entities and large losses.

This is general information, not tax advice.

Sources

1. Chief Counsel Advice 202302011: Applicability of I.R.C. section 165 to cryptocurrency that has declined in value (IRS Office of Chief Counsel)
2. Chief Counsel Advice 202511015: Allowance of Theft Losses for Victims of Scams Under I.R.C. Section 165 (IRS Office of Chief Counsel)
3. 26 U.S. Code § 165 - Losses (Legal Information Institute, Cornell Law School)
4. 26 U.S. Code § 67 - 2-percent floor on miscellaneous itemized deductions (Legal Information Institute, Cornell Law School)
5. CRYPTO22400 - Cryptoassets for individuals: Capital Gains Tax: losing private keys (HMRC)
6. CRYPTO22450 - Cryptoassets for individuals: Capital Gains Tax: being defrauded (HMRC)
7. CRYPTO22500 - Cryptoassets for individuals: Capital Gains Tax: S24 and negligible value (HMRC)

General information for finance teams, current as of publication. Not legal, tax or accounting advice.

All Newsroom explainers