Crypto was the costliest payment method in scam reports to Scamwatch in 2025. Victims reported A$121.3 million lost this way, or 36.2% of all Scamwatch losses. Many of those losses, like crypto taken in hacks, raise one tax question. Can the loss reduce the tax you owe on other gains?
Yes, the Australian Taxation Office (ATO) allows a capital loss for stolen crypto when you can establish that you owned the assets and meet the relevant requirements. Therefore, the evidence you keep and the income year in which the loss is claimed both matter. This guide explains how to prove a crypto theft or hack loss, when to claim it, and how the loss can affect your other capital gains. It is written for individual investors.
Key Takeaways
- The ATO accepts a theft or hack loss only when the crypto cannot be recovered.
- Ownership records, cost and value at the time of loss form the core of your evidence.
- Missed the loss in a lodged return? Individuals generally have two years to amend it.
- A theft loss offsets capital gains only and can carry forward with no time limit.
When Does The ATO Accept A Crypto Theft Or Hack Loss?
The ATO accepts a crypto theft or hack loss only when three conditions are all met. The crypto must be lost, you must have evidence you owned it, and access must be gone. Each condition closes off a different reason the ATO could refuse the claim.
Condition 1: The Crypto Must Be Lost
Lost has a strict meaning here. The ATO generally treats an asset you can recover as not lost at all. Its own example is crypto retrieved by extracting data from an old hard drive. If a specialist can restore the files, the crypto still exists in your hands. No capital loss arises.
The same logic applies when an exchange freezes withdrawals and enters administration. While recovery through that process remains possible, the crypto is locked rather than lost. A token that crashes after a rug pull also fails this condition, because you still hold it.
Condition 2: You Must Have Evidence You Owned It
The second condition shifts the focus from the crypto to you. A drained wallet proves only that crypto left an address, not who controlled it. The ATO therefore expects records connecting that wallet or account to your identity. Without them, even a genuine theft may not support a capital loss.
Ownership is usually easier to show for exchange hacks than for private wallets. An identity-verified exchange account already ties the holdings to your name. A self-custody wallet needs more work, often through purchase and transfer records. The evidence sections below set out what each type of loss requires in detail.
Condition 3: Your Access Must Be Gone
The final condition asks whether you can still reach the crypto in any way. A lost private key is the ATO’s clearest example, because it cannot be recovered. A wallet drained through a phishing link fits too. Blockchain transfers cannot be reversed, so access to those funds has ended for good.
An exchange hack is less clear-cut, because the platform may reimburse users. Until it is clear what, if anything, will be repaid, your access is not fully gone. How compensation then changes the claim is covered further below.
What Evidence Does The ATO Need For Stolen Or Hacked Crypto?
For stolen or hacked crypto, the ATO needs evidence that you owned it and lost it. Its guidance does not give a fixed checklist for theft, unlike a lost key. Your records therefore need to tell the full story on their own. Three types of proof carry most of the weight.
Proof That The Crypto Was Yours
Ownership is the first thing to establish, because the ATO ties every claim to it. Strong proof includes identity-verified exchange records showing the purchase and transfers into the wallet. The wallet address itself matters too. Transactions you can link to your identity show the wallet was under your control before the theft.
Proof Of What Was Taken And When
Next, show exactly what left your control. Blockchain transaction IDs record the outgoing transfers, their dates and the receiving address. Pair them with the crypto’s original cost and its Australian dollar value at that moment. The cost sets the size of your loss. Screenshots of the drained wallet add useful context alongside these records.
Proof That Recovery Is Not Possible
Finally, show that the crypto cannot come back to you. Keep emails with the exchange or wallet provider confirming no reimbursement will be made. A written refusal is far stronger than silence from the other side. Dated notes on any recovery attempts you made also show the loss is final.
Keeping Records Beyond The Exchange
Many investors let their exchange keep these records, which the ATO says is not enough. Exchanges can close, and a hacked account can lock you out of its history. Export your transaction history regularly and store copies somewhere you control. That backup may become your only proof after a theft.
What Evidence Does The ATO Need For A Lost Private Key?
For a lost private key, the ATO sets out nine types of evidence that establish your ownership. No single item is compulsory, but each one you hold strengthens the claim. The list below groups them by the question each answers. Collect as many as you can before lodging the return.
- The Public Key: This is the shareable half of the key pair. It can be checked without giving anyone access to the funds.
- The Digital Wallet Address For The Private Key: Anyone can look this address up on a blockchain explorer to confirm its balance and history.
- The Date You Acquired The Private Key: This shows when the wallet became yours and starts your ownership timeline.
- The Date You Lost The Private Key: This date decides which income year the loss belongs to, as explained below.
- The Value Of The Crypto In The Wallet When The Key Was Lost: Record this in Australian dollars, using a reliable price source for that date.
- The Cost Of Acquiring The Crypto In The Wallet: Purchase receipts or exchange records show what you paid, which sets the size of the loss.
- Evidence The Wallet Was In Your Control: Transactions you can link to your identity show you managed the wallet.
- Possession Of The Hardware Storing The Wallet: Keeping the device itself, even without the key, shows the wallet was physically yours.
- Transactions From An Identity-Linked Exchange Account: Transfers from a verified exchange account into the wallet tie the funds directly to your name.
How Long Do You Have To Claim A Crypto Theft Loss?
There is no separate deadline for reporting a crypto theft or hack to the ATO. You claim the capital loss in your tax return for the relevant income year. You must do this by the return’s lodgment deadline or within the allowed amendment period. Any compensation you receive can reduce the loss you claim.
Claiming In The Right Income Year
In the ATO’s own example, Alex bought 2 Ethereum (ETH) on 10 January 2025 for A$2,672. On 21 May 2026, Alex found the private key was lost. If Alex can prove ownership and loss, a capital loss of A$2,672 goes in the 2025-26 return. That figure is the reduced cost base of the ETH.
Here, the claim sits in the year of discovery, not the year the crypto was bought. That return is then due by its normal lodgment date, like any other. For self-lodgers, that date is 31 October after the income year ends. Registered tax agents can often lodge later, under their own lodgment program.
Amending A Return If You Missed The Loss
If a lodged return left out the theft loss, you can amend it. Individuals generally have two years to amend an assessment. The clock starts the day after the notice of assessment is sent. A notice sent on 3 November 2026, for example, allows amendments until 4 November 2028.
Sole traders get four years for the 2024-25 income year onwards. Once the time limit passes, an amendment is no longer possible. You may then need to lodge an objection, with an extension of time in some cases. Our walkthrough on filing your crypto taxes shows where the loss belongs in the return.
How Compensation Changes The Claim?
Compensation or insurance received for stolen crypto must reduce the capital loss you claim. If the payment exceeds the cost base of the lost crypto, you make a capital gain instead. A rollover can defer that gain in one situation. You must acquire another crypto asset within a year of the income year ending.
Real-Life Case Study
In February 2025, hackers pulled off what was then called the largest crypto theft on record. They took about US$1.5 billion in ether from Bybit, a Dubai-based exchange. The case is useful because a huge hack did not automatically create losses for customers. Running it through the ATO’s three conditions shows why.
How The Hack Happened?
The breach occurred during a routine transfer from Bybit’s offline cold wallet to its trading wallet. Attackers intercepted the transaction and redirected the ether to an address they controlled. Analysts at Elliptic linked the attack to North Korea’s Lazarus Group. The stolen funds were quickly split across dozens of wallets to hide their trail.
How The ATO Would Treat A Customer's Position?
The ether was taken from the exchange’s pooled storage, not from customers’ personal wallets. Within 72 hours, Bybit replenished its reserves using emergency loans and large deposits. An independent audit confirmed customer assets remained fully backed, and withdrawals stayed open throughout. Customers therefore kept both their balances and their access.
Against the ATO test, a customer’s claim fails at the first hurdle. Their crypto was never lost, because it remained in their account the whole time. Access never ended either, so the third condition also fails. With no loss to claim, the ATO would expect no capital loss in a customer’s return.
How A Capital Loss Could Have Arisen?
The outcome would have been very different if Bybit had not covered the shortfall. Customers losing access permanently, with no prospect of repayment, could then meet all three conditions. Their capital loss would equal the reduced cost base of the crypto lost. Any partial repayment would then shrink that figure accordingly.
Take a hypothetical Australian customer who bought 2 ETH for A$6,000 and held it on the exchange:
Outcome | Amount Received | Capital Loss Claimable |
Holdings fully backed (the actual outcome) | Holdings kept | None |
No repayment and access permanently gone | A$0 | A$6,000 |
40% repaid by the exchange | A$2,400 | A$3,600 |
The evidence rules above apply across these loss scenarios. Exchange statements, identity-verified account records and purchase history can help establish the claim, while the timing rules determine which tax return the loss belongs in.
However, Bybit customers did not need to rely on these rules because the exchange covered the stolen assets. For any exchange hack, therefore, the first question is whether the assets were recovered or reimbursed.
How Can KoinX Help You Prove A Crypto Theft Loss?
Proving a theft loss depends on records that are complete, dated and valued in Australian dollars. Gathering them by hand across several exchanges and wallets can take weeks. KoinX pulls that history into one place and applies ATO rules to it. The result is a clear trail from purchase to loss.
Transaction History Report
The Transaction History Report is a full ledger of trades, transfers, rewards and fees. For a theft claim, it shows how the crypto reached the wallet that was later drained. Each entry carries a date and value, supporting both ownership and cost. Keep an exported copy alongside your other evidence.
Auto-Classification Of Transactions
Every transaction in your history is automatically sorted into categories, such as trades and airdrops. Correct labels matter even more after a theft. An unauthorised withdrawal treated as a sale would distort the capital result you report in myTax. Reviewing each category lets you catch that error well before you lodge.
Accurate Preview
Accurate Preview shows your capital gains position while letting you move through each transaction. Once the loss is recorded, it helps you check how it changes that year’s gains. That check shows whether a net capital loss will carry forward. You can review the numbers before any report is generated.
Complete ATO Tax Report
The Complete ATO Tax Report applies ATO rules to your crypto data, including CGT discounts and income. It sets out capital gains and losses in a form ready for your return or accountant. Detailed portfolio balances sit alongside the figures. If the ATO questions the claim, the report shows how each number was reached.
A theft claim is only as strong as the records behind it. Connect your exchanges and wallets now, while every transaction is still easy to access. Then export the reports that prove what you owned and what you lost. Build your evidence trail with KoinX before the next lodgment date arrives.
Conclusion
The strongest theft claims are built before anything goes wrong. Record every wallet address and public key while you still have access. Back up exchange histories each quarter, and store copies away from the devices holding your crypto. If a theft ever happens, most of the proof will already exist.
When a loss does occur, act on two dates straight away. Note the day you lost access, then diarise that year’s lodgment due date. Missing either one can cost you the claim or push it into an amendment. Start organising your records on KoinX so the evidence is ready when you need it.
Frequently Asked Questions
Does The Personal Use Asset Rule Block My Theft Claim?
It can, although this rarely affects genuine investors. Capital losses from personal use assets are not allowable under ATO rules. However, crypto held as an investment is not a personal use asset, even if occasionally spent. Our article on whether crypto is a personal use asset explains where that line sits.
Do I Need To Notify The ATO Separately About A Theft?
The ATO’s guidance does not describe a separate notification process. You claim the capital loss in your tax return for the relevant income year. Your evidence stays with you, ready to produce if the ATO later asks for it. Any email demanding an urgent crypto declaration should be treated as a scam.
Can A Crypto Theft Loss Reduce Gains From Shares Or Property?
Yes. A capital loss from stolen crypto can offset capital gains from other assets, such as shares. It works the same way against an investment property sale. Timing a later sale in the same year can use the loss sooner. This gives the loss value even when no crypto gains exist.
What If I Only Have Partial Records Of The Stolen Wallet?
Gather whatever you can from the ATO’s list of acceptable evidence. Exchange exports, bank transfers used to buy the crypto and blockchain records can fill many gaps. The deciding test is still proof of ownership. Without evidence linking the wallet to you, the ATO may not accept the claim at all.
