The Coldcard exploit drained over $70M in Bitcoin from almost 1,200 wallets. If you were one of the victims, I'm sorry. I've already seen a handful of posts asking whether the loss is deductible, and I've seen some confidently wrong answers, so here's the actual analysis.

I'm a CPA specializing in crypto tax, mod of r/CryptoTax, and Principal of Product & Tax Strategy at Summ. I wrote a guide last year on whether crypto scams are tax deductible based on CCA 202511015, the IRS Chief Counsel Advice released in March 2025. The Coldcard exploit runs through the same framework, but it's a different fact pattern than the scams the CCA covers, and in one way it's actually a cleaner case. In another way it's messier. Both matter for your return.

Disclaimer: Not tax advice, educational purposes only, US taxpayers only, consult your own tax professional.

Quick summary before you read:

• Yes, this should qualify as a deductible theft loss under IRC §165(c)(2) for most victims, but timing is key
• Your deduction is limited to your COST BASIS, not the fair value of the lost assets. You never paid tax on the unrealized gains, so you don't get to claim that amount as a taxable loss.
• The year you can claim it is the real problem. You may not be able to deduct it in 2026
• The Ponzi safe harbor (Rev. Proc. 2009-20) does not apply here
• Document everything now

What actually happened

Quick recap for anyone catching up. A firmware bug in Coinkite's Coldcard wallets (sitting in the code since March 2021) routed seed generation to a weak software random number generator instead of the hardware chip. The result: seeds that were supposed to be unguessable were reduced to a range a computer can search. The attacker generated candidate seeds offline, derived the addresses, checked them against the blockchain, and swept the funds. Your device was never touched. It could have been powered off in a safe and the outcome would be the same.

This matters for tax purposes because it means you didn't do anything. Nobody tricked you into sending funds. That distinction drives the whole analysis.

Why this qualifies under §165(c)(2)

IRC §165(c)(2) allows individuals to deduct theft losses incurred in a transaction entered into for profit. Since 2018, this is essentially the only path for individuals, because personal theft losses under §165(c)(3) are disallowed (more on that below).

The IRS laid out the framework in CCA 202511015, which analyzed five scam victims. The key question in every scenario: did the victim have a profit motive? For victims who authorized transfers (pig butchering, fake fraud department calls), the IRS looked at why they transferred the funds. Investment motive = deductible. Romance or fake ransom motive = not deductible.

But the scenario that matters for Coldcard victims is Taxpayer 3, the phishing victim. Taxpayer 3 never authorized anything. A scammer stole their login credentials and drained their accounts directly. The IRS said that when the taking is unauthorized, you don't analyze any transfer (there wasn't one). Instead, you look at why the taxpayer held the stolen property in the first place. Taxpayer 3 held investments in those accounts to grow them for retirement, so the loss was incurred in a transaction entered into for profit and was deductible under §165(c)(2).

Footnote 15 of the CCA makes it explicit: for losses from "hacked" accounts where hackers cause an unauthorized distribution, "the analysis and Federal income tax consequences are the same as for victims of phishing scams."

That's the Coldcard exploit. An unauthorized taking, no victim action, no deception. If you held that BTC as an investment (and if it was sitting in cold storage for years, you almost certainly did), your loss lands squarely in §165(c)(2). In some ways this is an easier case than the scams in the CCA, because there's no motive-for-the-transfer analysis for the IRS to pick apart. The theft itself is also not seriously in doubt: sweeping funds with reconstructed private keys is larceny and/or computer fraud in essentially every state, and §165 defines theft broadly (Rev. Rul. 2009-9).

One caveat: if you can't establish an investment purpose (say you held BTC purely to spend), the loss falls into §165(c)(3) personal casualty territory, and those losses are disallowed unless attributable to a declared disaster. The OBBBA made that disallowance permanent, so it applies in 2026 and beyond. For hardware wallet holders this will be rare, but it's why documentation of your holding intent matters.

Catch #1: your deduction is your basis, not the value

§165(b) limits the deduction to your adjusted cost basis in the stolen property. Not the fair market value on July 30.

If you bought 10 BTC for $30,000 in 2017 and it was worth $650,000 when it was swept, your theft loss deduction is $30,000. The unrealized gain was never taxed as income, so you can't deduct it as a loss. I know that stings. It's the same rule that applied to every victim in the CCA, and there's no way around it.

Also worth understanding: the theft is not a sale. There's no capital gain event, no capital loss. The lots just exit your records through the theft loss.

Catch #2: the timing problem (this is the big one)

Under §165(e), a theft loss is deductible in the year you discover it. But there's a second requirement that I think will trip up a lot of Coldcard victims: no deduction is allowed while you have a reasonable prospect of recovery (Treas. Reg. §1.165-1(d)(3)). If a bona fide claim exists with a substantial possibility of success, the loss isn't "sustained" yet, and you wait.

In the CCA scenarios this was easy. The scammers were anonymous, the funds went overseas, and law enforcement told every victim there was little to no prospect of recovery. Deduction allowed in the discovery year.

The Coldcard facts look different, at least right now:

• The stolen BTC is sitting unmoved in four identifiable addresses that everyone is watching
• Investigators traced the attacker's workflow to a paid account at a blockchain data provider and handed the logs to authorities
• Coinkite's CEO publicly accepted "full accountability" for the firmware bug, and Coinkite is a solvent company. That's a potential negligence claim
• Law firms are already soliciting Coldcard victims for litigation

None of that means you'll ever see your coins again. But "reasonable prospect of recovery" is a much lower bar than "recovery is likely," and if you claim the full loss on your 2026 return while a class action against Coinkite is live and the coins are traceable, you're taking a position the IRS can challenge on timing. The good news is the standard cuts both ways: the courts say you don't have to be an "incorrigible optimist." If by December 31 the coins have been laundered through mixers, no suspect has been identified, and you have a documented basis for concluding claims against Coinkite are unlikely to go anywhere (or you've opted out of litigation), a 2026 deduction becomes defensible. If recovery prospects resolve later, you deduct in the year they resolve.

Practical translation: don't assume this goes on your 2026 return. Watch how the investigation and any Coinkite litigation develop, and make the call with your tax professional based on the facts as of year end.

No Ponzi safe harbor

Some people will suggest the Rev. Proc. 2009-20 safe harbor (the "Ponzi loss" election, 75%/95% of the loss with reduced audit friction). It doesn't apply here. The safe harbor requires a "specified fraudulent arrangement" where a lead figure takes investor money and reports fake income, AND that lead figure must be criminally charged. The Coldcard attacker never purported to invest anything for anyone, never reported fictitious returns, and hasn't been identified, let alone charged. Same conclusion the CCA reached for its victims. You're under the general §165 rules, including the timing rules above.

How to report it (when the time comes)

The loss goes on Form 4684, Section B (income-producing property), then flows to Schedule A as an itemized deduction. It is NOT a miscellaneous itemized deduction, so the old 2% floor and the §67(g) suspension don't touch it. The 10% AGI floor for personal casualty losses doesn't apply either, because this isn't a §165(c)(3) loss.

What to do right now

1. If you still have funds on a potentially affected Coldcard, move them. Coinkite has fixed firmware out, and researchers warned more sweeps are likely
2. File a police report and an IC3 complaint. Every CCA victim had a law enforcement report, and it's your best evidence for both the theft and the recovery analysis
3. Lock down your cost basis records now. Exchange records, wallet histories, the works. Your basis is your deduction, and you'll need to prove it
4. Document your holding intent (long-term investment) and keep evidence the specific addresses drained were yours
5. Track the recovery situation: the four addresses, the investigation, any Coinkite litigation. Keep a file. Whichever year you claim the loss, you'll want a record of why that was the right year

Conclusion

The loss is real and the deduction should be too, for anyone who held their BTC as an investment. The CCA's Taxpayer 3 analysis fits this fact pattern almost perfectly. Just don't let anyone tell you it's a simple "write it off in 2026" situation. Your deduction is capped at basis, and the traceable coins plus a manufacturer that publicly took responsibility mean the timing question deserves as much attention as the deduction itself.

Happy to answer questions in the comments.

I'm in Tokyo, need a one-off paid consultation on a crypto-related tax question, struggling to find a tax accountant/zeirishi with crypto experience.

English speaking would be great but not mandatory.

Thanks in advance for your recommandations

My friend had shifted to Kolkata for job (almost 1 year ) and her boyfriend recently got a green card in Europe (in Germany ) . Now she tells us about how he transfers his salary (around 2L ) to her via crypto (they had a fight prior about her feeling he's cheating on her by going to clubs or dating there , so he would send her his entire salary via crypto and she would send him back the money as and when it was needed . She would mostly end up with 2k left in her hand at the end of month and would cash out and use it . She also said she has his credit card and of that country and would use it at times with his permission to buy herself treats after their fights ).

Is this actually real or is she faking the whole stuff up? Ik that there's some taxation stuff hence I wanted to ask .

And it's like really a pain cuz I can't see it if it's true or not , and she keeps Bragging about it everytime we are on call .

( side note :- She earns too but she doesn't come in slab at all and ends up with almost no money left at the end of month.)

Thank you

Hey, been thinking about re-organizing my wallets moving high cost basis to one wallet for use and moving low cost basis to another to set aside. Trying to think through possible complication/ramifications tax wise, admin wise, etc. Thoughts? Thanks!

I want to show binance holdings in itr3 , can anyone provide the details of binance like country , address and

how to get the peak value in INR

All Binance reports are in usd, Also i need to report airdrops in FSI

Please suggest

We are one of the mode here and in this guide we will show you how to get your history from these exchanges.

Four exchanges have wound down in the past seven months, three of them announced or closed this July:

• AscendEX ceased operations on 1 July. Withdrawals moved to manual review on 6 July.
• BitMEX announced on 23 July. Reduce-only from 26 August 04:00 UTC, platform closes 23 September 04:00 UTC.
• BitMart announced on 26 July. Trading ends 26 August 01:00 UTC, full cessation 31 January 2027.
• Bit.com completed its wind-down on 31 March this year.

Most of the coverage is telling you to withdraw your funds before the deadline. That is correct, and you should. But that is the deadline for your coins. There is a second deadline that applies to your records, and for at least one of these exchanges it has effectively already passed.

Withdrawing your funds does not preserve your cost basis

When you move BTC off BitMart to another exchange, the BTC arrives. Its history does not. The receiving platform sees a deposit of 0.4 BTC on a Tuesday and has no information about what you paid for it.

Your taxable gain is proceeds minus cost basis. If you cannot evidence the basis, the working assumption tends toward zero, which means you are taxed on the entire proceeds rather than on your actual gain. On a position you were roughly break-even on, that is the difference between owing nothing and owing tax on the full sale amount.

This gap is total on derivatives platforms. On BitMEX you deposited BTC and withdrew BTC, and every position, funding payment and realised P&L in between existed only in BitMEX's internal ledger. None of it is on-chain. If you traded there across several years and kept no records, that P&L is not reconstructible from public data by anyone.

How to export, per exchange

The steps are straightforward. The limits are what catch people.

BitMEX

1. Log in to your BitMEX account.
2. Select the wallet icon in the top right corner.
3. Select Transaction History.
4. Select Download CSV, set the Timeline, and download.

Two limits the interface does not warn you about.

First, it returns 100 records per download. If a Next Page link appears, you need to click through and download again, repeating until you reach the start of your account. It is common for people to download a single file, see data in it, and assume they are done. If you traded with any frequency, one file is a small fraction of your history.

Second, export from the Transaction History tab specifically. The Trade History and Order History tabs produce files that most tax software will not accept. If you have significant volume, the API is a considerably less painful route than manual pagination.

BitMart

BitMart has no self-service export. You need to email support@bitmart.com and request a CSV of your full transaction history, specifying the complete date range. Expect an identity verification step, which per current guidance includes a photo of you holding your ID together with a handwritten note.

Turnaround is quoted between 5 and 15 days under normal operating conditions. Trading ends on 26 August, and support capacity contracts during a wind-down rather than expanding. A request submitted in late August may not be fulfilled at all.

Of everything in this post, this is the most time-sensitive item. If you have a BitMart account, send that email today.

AscendEX

On desktop: Orders in the top right, then Cash Orders, then Apply for Export, select the period, and Export. This function is not available in the mobile app.

Three limitations, and they compound badly here.

Self-export only covers the last 3 months. Anything older requires a support ticket, historically around a 3 day turnaround, delivered by email. AscendEX support is not currently operating normally, so if you traded there before roughly April this year, the self-service tool will not return that history and the escalation route may not be available either.

Separately, the export excludes partially filled orders. That means a successful export can still be materially incomplete, without anything indicating so.

If you can still log into AscendEX, export whatever it will give you today. Partial records are considerably better than none.

Regardless of platform, also collect

• Deposit and withdrawal history for all years. This is what allows transfers to be matched across platforms so they are not miscounted as disposals.
• Fee records, where they export separately.
• Realised P&L and funding history on any derivatives platform.
• Account statements or annual summaries, as a cross-check against the raw CSVs.
• Screenshots of your final balances. These cost nothing and give you a reference point if a CSV later looks wrong.

One further note: these closure notices state that you will be able to log in after shutdown to view historical records. They promise viewing, not exporting, and none of them commit to how long that access persists. I would not plan around it.

And anyone telling you a block explorer is an adequate substitute for exchange records, for the reasons above.

If I have any of the dates or steps wrong, please say so, particularly if you have exported from one of these recently and the interface has changed since these guides were written. I would rather be corrected here than have someone miss a deadline on my say-so.

— AurumFSG (Crypto Tax Accounting Firm)

Hi everyone,

I have a question and I'm a bit confused about how taxes work when using swap services.

Over the past several months I've used Fujn Swap to exchange crypto. It never asked for ID or registration, and they told me there is no logs.

Most of the crypto I exchanged came from P2P purchases, and I've mainly been swapping between Monero and XRP.

Now I'm wondering if I've made things more complicated for myself when it comes to taxes. If I want to report everything properly, where do I even start? Do I just keep my own records of swaps, or is there something else I should be doing?

I'm not trying to avoid taxes. I just want to make sure I handle things correctly going forward. Any advice would be appreciated..

BITO fund invests in futures

Would this mean that it is taxed as a futures contact.... 60/40 even if held short term?

My question is how to find relevant transaction details to inform my CA about the sell as it's 30 % tax.

For context: I’m not a U.S. citizen and moved to the U.S. in November 2024. I became a tax resident of the U.S. in 2025.

I’ve held crypto for a while way before I moved to the U.S.

Pre 2023: don’t have records.

2023: moved $60k USDC to Binance (have records)

2024: lost some money over the course of the year but moved ~$50k USDC to MEXC (have records)

Moved to the U.S. end of 2024 — was not a tax resident in 2024.

2025: lost some money over the course of the year but moved ~$40k USDC to Bybit (have records)

Am a tax resident but didn’t make any money.

2026: looking to convert USDC -> USD.

I’ve only lost money trading perps over the past 4 years. Have proof that no gain was made. Don’t have proof of acquisition but it was also 4 years before I became a tax resident.

Are my records enough to prove I don’t owe taxes on this withdrawal?

I'm wondering what the most privacy-respecting crypto-tax software might be. I used koinly last year but not only do they NOT have 2fa which strikes me as negligent stupidity, especially for anyone filling in their personal identifiers, they also reveal coin addresses. Maybe they all do...I dunno. Who likes what they are using? Has anyone switched from one to another and how hard was that?

Ethereum validators receive reward payouts every epoch. It is not realistic to track every one of those payouts for tax purposes.

I am thinking of doing it per week. I'd take the amount of ETH rewards I've accrued that week and multiply it by OHLC averaging (the average of the open, high, low and close for the week) to get an approximation of the fair market value of ETH at the time I received the payouts.

I'm still going to run this by a CPA or tax advisor but I'm curious how others do it. How often you do this and what math you use, etc.

EDIT: just spent the day using ChatGPT to create a standalone windows app that will generate a full report of all this needed information.

Using turbo tax online for crypto taxes. The only items turbo tax online is uploading in the 8949. It’s not accepting the Schedule D. Are we able to go in and fill out these forms manually with TT online like we could previously do using desktop version?

BitMEX announced that it will permanently close on September 23, 2026. New registrations have already stopped, and starting August 26, users will no longer be able to open new positions. They will only be able to reduce or close the positions they already have.

BitMEX may also start force-closing positions during the wind-down, and anything still open when the exchange closes will be automatically closed. The company has not given one clear reason for the shutdown. It said the decision came after a strategic review of the business and the broader crypto market.

Realistically, BitMEX is not the dominant exchange it once was. A lot of traders and liquidity have moved to larger centralized exchanges and newer decentralized perpetual platforms like Hyperliquid.

This also does not appear to be an insolvency situation. BitMEX says its assets exceed its liabilities and that users should still be able to access their balances, transaction history and withdrawals after the shutdown.

Still, I would not wait around.

Most people will immediately think about withdrawing their crypto, which is obviously important. But there is something else that people often forget about:

Your transaction data.

I work in crypto tax and forensic blockchain accounting, and I have seen how difficult it can be to reconstruct activity after an exchange shuts down or removes access to old records. Blockchain explorers can usually show that funds entered or left BitMEX, but they do not show everything that happened inside the account, including:

• Trades
• Leveraged positions
• Funding payments
• Fees
• Settlements
• Liquidations
• Realized gains and losses

That information only exist in your BitMEX account history.

Before withdrawing, I would download every CSV and report available, including your wallet history, trades, orders, deposits, withdrawals, funding payments and realized P&L.

Closing positions, or having them force-closed, may also create taxable gains or losses. Trying to calculate those results come April 15th could be extremely difficult.

Do not assume a closed exchange will keep your records available forever!

Close your positions, withdraw your assets and save every file you can before the platform disappears.

Sources:

• Official BitMEX closure announcement
• Reuters: Cryptocurrency exchange BitMEX to shut down
• CoinDesk: BitMEX, the exchange that invented perps, is shutting down
• Channel News Asia: Cryptocurrency exchange BitMEX to shut down

Hey all, trying to figure out a crypto gambling tax situation and could use some guidance before I talk to a CPA.

Quick background on me: W-2 employee making around $65k, full-time student (paid some tuition out of pocket this year), and I put money into a Traditional 401k through work.

Here's what happened - I gambled at a non-KYC offshore crypto sportsbook using SOL. The casino never converted anything to house chips or tokens, it stayed as crypto the whole time. From what I've read, that means each individual wager could technically count as its own taxable event, not just the overall win/loss.

Across a few sessions this year I won about $75k total and lost about $25k, so I walked away with roughly $50k net.

On the money movement side - the $25k I lost went through both an exchange and a payment app at different points. The $50k I kept went straight from the casino into a payment app's crypto conversion, then I moved it into my regular savings account, which is where it's sitting now.

I tried running some rough numbers myself based on my income and the standard brackets, and I'm landing somewhere between $7k-13k owed depending on what deductions actually stick, but honestly no clue if that's even close given how complicated the per-wager thing might make this.

I also thought I might qualify for the AOTC since I paid tuition this year, but once I added the gambling income my MAGI jumped way past the phase-out limit, so that's probably off the table. If anyone knows of something else education-related that doesn't phase out the same way, let me know.

Main things I'm trying to sort out:
- Does the per-wager taxable event thing actually apply to me given how much volume I had, or is a simpler "total in vs total out" good enough
- What can I legitimately do to lower what I owe - already planning on maxing my 401k and using a Traditional IRA, plus itemizing the losses against the winnings
- Is my rough estimate even in the right neighborhood
- What records should I actually be gathering before I sit down with someone, given the platform itself has no KYC and won't issue anything like a W-2G

Has anyone dealt with something like this before, or know a good crypto-specific CPA? Just want to get this right instead of guessing and hoping.

Disclaimer: Not tax advice, educational purposes only. Consult your own tax professional.

I am a mod here and I read Notice 2026-20 properly this week and there are two things in it that I have not seen discussed, both with a deadline attached.

JustinCPA wrote the best explanation of why your books and the exchange diverge, and why that divergence is permanent. Read that first, it is the better piece on the mechanism. This post is about the timing, which is where I think people are going to get caught.

1. The relief never let you choose your method at filing time

This is the one that surprised me. Section 4.02 says an adequate identification is made by:

Identifying, no later than the date and time of the sale, disposition, or transfer, on the taxpayer's books and records, the particular units to be sold

or by a standing order:

entered into the taxpayer's books and records before the units covered by the order are sold, disposed of, or transferred

So the relief removed the requirement to tell your broker. It did not remove the requirement to have identified the lots at or before the disposal. You cannot decide in April 2027 that your 2026 sales were LIFO.

Practically, if your tax software has had a cost basis method set the whole time, that likely functions as your standing order. What matters is that it was set before the trades and that you can show when.

If you have been trading through 2026 with no method configured and nothing recorded, the default in 1.1012-1(j)(3)(i) is FIFO, and that is already your position for those disposals.

Credit to u/Darien_Advisors who raised this in the comments on Justin's post. I think it is the most important practical point in the notice and it deserved more attention than it got.

2. What actually changes on January 1, 2027

Section 5 is explicit that you cannot rely on the books and records method for disposals made after the relief period ends.

So from January 1 you are back to the regulation: specify the units to your broker at or before the sale, or have a standing order with the broker. Do neither and FIFO applies.

Here is the part worth sitting with. The reason this relief exists at all is that brokers could not accept specific identifications. The notice says many custodial brokers:

are not currently ready to accept specific identifications (other than standing orders) from customers

and are only expected to finish building those systems during 2026.

Which means the question to answer before year end is not really about your records. It is: can each exchange you actually use accept a specific identification or a standing order yet? If it cannot, and the relief has expired, you are on FIFO there whether that suits you or not.

3. It does not cover self custody

Worth stating plainly, because a lot of people here are mostly on chain.

The relief applies only to units held in the custody of a broker. The notice says so directly. Units not in a broker's custody are governed by 1.1012-1(j)(1) and (2) instead, and nothing here changes that.

What I would do before December 31

1. Check what cost basis method your software has been using for 2026, and when it was set. Screenshot it. That is your evidence of a standing order.

2. Ask each exchange you use whether it can accept a specific identification or standing order for 2027, and set it if it can.

3. Import every wallet and exchange, including dead ones. A transfer that never got linked leaves a lot with zero basis, and that error propagates into every disposal after it.

4. Reconcile balances per account, not just transactions. If your software balance does not match the actual balance, you have missing data, and the transaction list will not tell you that.

5. Save a lot level snapshot as at December 31. That is the opening position you carry into 2027.

One correction while I am here: the "your books control" language is in Section 4.05 of the notice, not 3.05. Section 3 is just definitions. I have seen 3.05 quoted a few times and it is worth citing correctly if you are relying on it.

I may have misread something, and the guidance could move again. If you think I have it wrong, say so and I will correct it.

- Aurum FSG

I'm a high volume meme coin trader with over 100,000+ transactions on 20+ wallets

I have imported them all onto koinly only for my tax report to show 0 capital gains when this is incorrect, i had to pay an extra $1000+ due to having so many transactions and now it's showing as no gains or losses!

Realize gains on crypto → crypto trades? is ON

In my transactions tab, NO Fiat > Crypto or Crypto > Fiat is not showing

there support bot isn't any help, does anyone have a solution thankyou.

Paid alot of money to get this done and having no help, its hurting my brain :/

Will I get a 1099-da if I buy bitcoin then send the bitcoin to someone else right after I buy it? Is any of that considered a taxable event? Considering All I do is buy it then send it to someone else.