If you have lost crypto to a hack, a phishing attack, or an exchange collapse, you are not alone. NZ crypto users have collectively lost millions of dollars to FTX, Cryptopia, scam protocols, and individual wallet compromises. The good news: the IRD does allow a deduction for stolen crypto in certain circumstances. The bad news: those circumstances are narrower than most investors expect, and the documentation bar is high.

The IRD's position on stolen crypto

You can claim a deduction for stolen cryptoassets only if any income from their sale would have been taxable. In practical terms, that means:

• The stolen assets were trading stock of a crypto-related business, or
• You acquired the assets with the intention of disposing of them or making a profit (the most common case for retail investors)

If the assets would not have been taxable on disposal (for example, if you held NFTs purely for personal use), you cannot claim a deduction for the loss.

For the broader framework, see our New Zealand Crypto Tax Guide.

How much can you claim?

The deductible amount is the original NZD cost you paid to acquire the crypto, not the market value at the time of the theft. For example, if you bought 1 BTC for NZD 25,000 and it was stolen when BTC was worth NZD 110,000, your deduction is NZD 25,000.

This is a meaningful constraint. If your portfolio has appreciated substantially before being stolen, you do not get to deduct the unrealised gain.

When can you claim?

The deduction is claimed in the income year the crypto was stolen, not the year you discovered the theft (where these are different) and not the year you finally gave up hope of recovery. If the theft happened in March 2026, claim in the 2025/2026 tax return. If it happened in April 2026, claim in the 2026/2027 tax return.

For exchange collapses, the year of loss is generally the year the exchange entered liquidation or formally communicated that user funds were unrecoverable, not the year the platform first paused withdrawals.

Evidence you need to support a claim

The IRD's documentation expectations for stolen crypto are demanding. You should be able to produce:

• Proof of original acquisition: Exchange purchase records, bank statements, on-chain transaction hashes, and the NZD value at acquisition
• Proof of ownership immediately before the theft: Wallet balances, exchange account screenshots, transaction history
• Date of the loss: The specific date the theft occurred
• Wallet addresses involved: Both the source wallet (yours) and the destination wallet (the attacker's)
• Transaction hashes: The on-chain record of the unauthorised movement
• Police report: Where one was filed, including the report number
• Exchange correspondence: Any communication with the exchange about the incident, including incident response tickets and final outcomes
• Communications related to phishing or social engineering: The original phishing email, message, or website that led to the loss, where applicable

The more contemporaneous your documentation, the stronger your claim. Reconstructing evidence years after the fact is significantly harder than capturing it at the time.

Lost crypto vs. stolen crypto

The IRD draws a clear line here. Stolen crypto can attract a deduction in the circumstances above. Lost crypto, where you have simply lost access to your private keys, seed phrase, or hardware wallet without theft involved, generally does not qualify for a deduction. The reasoning is that the asset still exists; you have just lost the ability to access it.

This is a hard line for many NZ investors who lost early-cycle Bitcoin to forgotten passphrases or discarded hard drives. There is no IRD relief available in those cases.

Recovery and clawback

If you successfully claim a deduction for stolen crypto and later recover the assets (for example, through law enforcement seizure of attacker funds, an exchange creditor distribution, or insurance), you must include the recovered amount as income in the year you receive it. The amount included is the NZD value at the time of recovery, capped at the deduction you previously claimed.

Insurance compensation works the same way: if your wallet provider, custodian, or personal cyber insurance pays out for a theft, the payout reduces your deductible loss or counts as income depending on the timing.

How to claim in Summ

Summ has a dedicated transaction type for lost or stolen crypto, which preserves the original cost base for the deduction calculation. To use it:

1. Locate the affected transactions in your Summ account (typically the outgoing transfer to the attacker's wallet)
2. Change the transaction type to "Lost or Stolen"
3. Enter the date of the loss and the NZD value at acquisition
4. Add notes referencing your supporting documentation (police report, transaction hash, exchange correspondence)
5. Summ then includes the deduction in your NZ tax report, ready for the IR3

If you have already filed without claiming

If you suffered a theft in a prior tax year and did not claim a deduction at the time, you can amend the relevant IR3 through myIR. The IRD's standard time bar for self-assessment amendments is 4 years from the end of the tax year in which the return was filed, so older losses may be out of reach. A tax agent can advise on whether your specific case qualifies.

For a full picture of how crypto tax works in NZ, including how lost or stolen claims fit alongside ordinary disposals and income, see the New Zealand Crypto Tax Guide. Or get started with Summ to flag affected transactions in your ledger.