Your crypto got hacked. The CRA still may not let you write off what you lost.
By Dilan Ropero · Canada · August 2026
In late July, roughly $116 million in Bitcoin drained out of hardware wallets people had been told were about as safe as crypto gets. If your first instinct is "well, at least a theft is a write-off," this is worth ten minutes. In Canada, a stolen coin is not the clean deduction most people assume, and what you can claim comes down almost entirely to records you may not have kept.
What the Coldcard hack actually was
Coldcard is a hardware wallet made by Coinkite, popular with Bitcoin holders precisely because it keeps keys offline. Starting July 30, 2026, funds began disappearing in waves. By the time it was pieced together, roughly 1,816 BTC, about $116 million, had been taken from more than 5,200 addresses. The first wave alone drained close to 594 BTC from around 500 wallets in under half an hour.
The cause was not stolen devices. It was a firmware bug from 2021 that, on some devices, generated wallet seeds using weak software randomness instead of true hardware randomness. That quietly reduced the strength of those keys enough that they could be guessed by brute force, with no physical access required. Updating the firmware protects future wallets, but it does nothing for a seed already created under the flaw. Those funds had to be moved to a brand-new wallet or they stayed exposed.
That is the security story, and it is everywhere. Here is the part nobody is covering: what a loss like this does to your taxes.
Problem one: you claim your cost, not today's value
If a theft loss is allowed at all, you can generally only claim your adjusted cost base (ACB) - in Canada, the average cost of every unit of that coin you hold - not what the coins were worth the day they were stolen. With a single purchase that is simply what you paid; buy at different times and it is the blended average. The gain you never sold is simply gone. It was never taxed, and it never gets deducted either.
Here is what that looks like in real numbers. Say you bought one Bitcoin years ago for $900 - your only purchase, so your ACB is that $900 - and held it while it climbed to $100,000. Then it vanishes in a hack.
Your claimable loss is your cost base (ACB), not the market value on the day it was taken.
Same coin. A six-figure hole in your net worth, and a $900 line on your return. That gap catches people completely off guard, and it is the rule, not an edge case.
Problem two: the burden of proof is entirely on you
The CRA has no specific published guidance on lost or stolen crypto, so it is handled case by case, and you are the one who has to build the case. To claim anything, you generally need to show three things.
You owned it
Wallet addresses and records that tie the coins to you.
What you paid
Original purchase records that establish your cost base.
It is gone for good
Evidence it is unrecoverable and will not be reimbursed, such as a police report.
And even when you clear all three, the loss is a capital loss, usable only against capital gains. It does not come off your salary or your business income. If you have no gains to offset, it sits and waits. Net capital losses can be carried back three years or forward indefinitely, but they only ever shelter other gains.
A quick but important exception
If you hold crypto as part of a business rather than as an investment, the analysis is different. Theft of business property can be treated as a non-capital business loss when it is an inherent risk of the operation. Whether you are on capital account or income account is a real, fact-specific question, and it changes the answer.
The phantom loss
Put those two problems together and you get what I have started calling the phantom loss: a deduction you are genuinely entitled to, that you cannot actually claim, because the records that prove it were never kept, or lived only on the device that got compromised.
It is the mirror image of the phantom gains I have written about before, where a dead exchange leaves you with proceeds and no cost basis, so a break-even year looks like a windfall. Same root cause, opposite direction. In both, the tax outcome is decided not by what happened to your money, but by what you can prove happened.
What to do this week
You do not need to be a Coldcard user for this to apply. Any self-custody holder is one bad day away from needing exactly these records, and the time to build them is before you need them.
Save your purchase records for every wallet. What you paid, when, and from which platform.
Store them off the device. Somewhere separate from the wallet, so a compromised device cannot erase your evidence along with your coins.
Keep a map of your wallet addresses. So ownership can be shown later without scrambling.
Already been hit? Do not assume it is a clean write-off, and do not assume it is nothing. Get the records read before you decide anything.
Why this matters more, not less, in 2027
Under the reporting rules Canada is set to bring in (CARF, starting January 1, 2027), exchanges will report account activity to the CRA. That makes your proceeds increasingly visible, while your cost basis and your losses stay your responsibility to prove. The records gap does not just cost you on a hack. It is about to cost people on ordinary filing too.
Get the Crypto History Reconstruction Worksheet
The same tool we use with clients. It walks you through rebuilding a complete, defensible record of what you bought, when, and for how much, including from exchanges that no longer exist. Free, fillable, and yours to keep.
Not sure what your records would actually support?
A 15-minute call is not the work and it is not a sales pitch. We look at what you have, tell you honestly where you stand, and whether there is anything worth doing before 2027.
Book your 15-minute callQuick answers to what people ask us next
My crypto was stolen. Can I just deduct what it was worth?
Generally no. If a theft loss is allowed, it is based on your cost base (your adjusted cost base, or ACB), not the market value on the day of the hack, and it is a capital loss that only offsets capital gains.
The CRA has no crypto theft rule. So what happens?
It is assessed case by case under the general rules for stolen capital property, and the burden of proof is on you. Documentation is everything.
What records do I actually need?
Proof you owned the coins, proof of what you paid, and proof the loss is permanent and unreimbursed, kept somewhere separate from the wallet itself.
Sources
- TRM Labs, Inside the $116 Million Coldcard Hack
- Fortune, Bitcoin owners rocked by $116 million hack
- Koinly, Are Crypto Losses Tax Deductible in Canada?
- David Rotfleisch / Mondaq, How the CRA Treats Stolen Property Tax-Wise
