Crypto stolen or lost: report to police & tax authority

Your wallet is hacked for €40.000. Or a rugpull token you staked €5.000 in last year turns out to be an empty contract. The question every victim asks: can I declare that loss to the tax authority, and how do I do that?

The short answer: sometimes yes, often no, and rarely simple. Under the new Belgian capital gains tax (from 1 January 2026) crypto losses are deductible, but theft and hacks follow a separate logic. In this guide we explain which steps you need to take, what evidence you need, and when a loss does or does not count for tax purposes.

🚨 First steps after a crypto theft

Before we look at the tax side: act fast. The more evidence you gather in the first 48 hours, the stronger your case will be later (both for a possible recovery and for your tax return).

1. File a police report. Via politie.be/e-loket or in person at your local police zone. Explicitly mention "theft of digital assets" and provide the wallet addresses and transaction hashes. Ask for a copy of the police report (PV number).
2. Report to the CCB. The Centre for Cyber Security Belgium (ccb.belgium.be) collects cybercrime reports, including for crypto incidents via safeonweb.be.
3. Preserve blockchain evidence. Note down immediately: the transaction hash of the theft, the recipient address of the thief, a screenshot of the wallet at the moment of the hack. Tools such as Etherscan or Arkham Intelligence let you trace the flow of funds.
4. Contact the exchange. If the stolen funds were sent to a known exchange, submit a formal freeze request (with the PV number as an attachment).
5. Notify your crypto tax platform. In Cryptotax you can manually label transactions as "theft" or "lost", so that they are treated differently in the reporting than a normal sale.

📋 The three scenarios: what exactly happened?

The tax treatment depends strongly on the type of incident. Three main categories:

(a) Theft or hack of your wallet

Someone compromised your private key, seed phrase or exchange account and siphoned off the funds. Classic examples: phishing attacks, malware on your device, sim-swap, stolen hardware wallet. Here there is a third party who has misappropriated your assets.

(b) Exchange bankruptcy or insolvency

Think of FTX, Celsius or Mt. Gox. Your crypto is (or was) held at a platform that went bankrupt. Your assets are not "stolen" in the strict sense, but they are lost or blocked. The tax treatment is linked to the moment at which the loss becomes "definitive" (often only after a ruling by the insolvency administrator (curator)).

(c) Rugpull or scam token

You bought a token, the developers disappeared with the liquidity, or the smart contract contained a backdoor. Here you sold nothing, but your position is practically worthless. The question: do you have a realised loss, or are you still holding "dust" in your wallet?

💸 Tax deductibility: when yes, when no

Under the Belgian capital gains tax (Art. 90, 2°/2 WIB 92, in force from 1 January 2026) capital losses are deductible from capital gains within the same taxable period. But theft is not a "realisation" in the classic sense (there was no sale), which complicates matters.

The core: for private investors the tax authority requires a moment of realisation. With theft, that is harder to pinpoint than with a normal sale. In practice, the administration usually accepts theft losses only when:

• There is a police report from the federal police or a specialised service
• Blockchain tracing shows that the funds are unreachable (e.g. sent to a mixer or hacked exchange address)
• A reasonable recovery attempt has failed

🧾 What evidence do you need?

The tax authority requires proof "by all means of ordinary law" (Art. 102, §5 WIB). Gather at least:

• Police report (PV) from the police (essential)
• Transaction hash of the theft transfer and the recipient address
• Wallet statement or exchange statement before and after the theft
• Screenshots of phishing emails, fake websites or malicious contracts
• Correspondence with the exchange or platform (support tickets, emails)
• Blockchain tracing report via Etherscan, Arkham or a specialised firm
• Export from your crypto tax tool with the transaction labelled as "theft"

Keep this for at least 7 years (the general retention period for tax documents in Belgium).

📝 How do you declare it in Tax-on-Web?

For assessment year 2027 (income year 2026) this is the workable framework for a realised theft loss you want to offset:

1. Box XV (Miscellaneous income / Capital gains on financial assets). This is where the net result of your realised capital gains and capital losses from category C (shares, bonds, funds, crypto) goes. The theft loss therefore first reduces your positive capital gains for that same year.
2. Code for capital losses: the definitive codes are published by FOD Financiën (the Belgian tax authority) when the new tax return pages are released. Follow financien.belgium.be and our step-by-step plan blog for updates.
3. Attach supporting documents: PV number, blockchain evidence and exchange correspondence as a PDF with your case file (Tax-on-Web allows uploads via "Attachments").
4. Keep your working document: an Excel file or an export from Cryptotax with the calculation of the net result (gross profit, losses, exemption).

Bear in mind: there is no carry-forward under the 10% regime. A net loss from 2026 cannot be carried over to 2027.

⚠️ When may you NOT deduct the loss?

Important limitations for the private investor:

• Lost seed phrase without a third party. If you lost access yourself (forgotten password, broken hardware wallet without backup), there is no "theft" and no realisation. For tax purposes: not deductible.
• No police report. Without a PV your case file is extremely weak. The tax authority almost never accepts this.
• Loss in a year without capital gains. You can only offset your loss against capital gains from the same year in the same category. A 2026 theft without gains in 2026 therefore yields no tax benefit.
• Rugpull where you still "hold" tokens. As long as you have not sold or burned the worthless tokens, the loss is not realised. Tip: send the tokens to a burn address and keep the transaction hash, or sell them for a symbolic €0,01.
• Assets on a blocked exchange without a formal determination. Only when the insolvency administrator (curator) officially confirms the loss can you include it.

🧮 Practical example: Anna loses 5 ETH

In March 2026, Anna clicks on a phishing link posing as her wallet provider. A thief empties her wallet: 5 ETH are siphoned off to an unknown address. Market value at that moment: €17.500.

What Anna does:

1. On 12 March 2026 she files a report digitally via politie.be. She receives PV number FED.2026.03.12.001234.
2. She traces the stolen ETH via Etherscan: the funds vanish into Tornado Cash, no recovery possible.
3. In her Cryptotax dashboard she labels the outgoing transaction as "theft", so that it does not appear as a normal sale in the capital gains calculation.
4. In October 2026 Anna sells part of her BTC at a €22.000 profit.
5. At the tax return (May 2027) she bundles: PV, blockchain export, Cryptotax report and exchange statement.
6. Calculation: €22.000 BTC profit - €17.500 ETH theft = €4.500 net capital gain. That falls under the annual exemption of €10.000. Anna pays €0 capital gains tax.

Without the theft case file Anna would have paid €1.200 in tax (10% on €12.000 above the exemption). A solid case file is therefore literally worth money.

❓ FAQ

Is a police report really mandatory?
Legally no, but in practice yes. Without a PV you have no credible evidence of theft. Always do this, even if the chance of recovery is small.

What if the exchange (such as FTX) makes a payout years later?
A later recovery is treated for tax purposes as a new receipt. Your original loss deduction stands, but the payout may be separately taxable depending on its nature (return of capital versus yield).

Do gas fees or bridge fees count towards my loss?
No. Transaction costs are not deductible under the capital gains tax (see also our guide on capital losses).

I am the victim of a rugpull. How do I prove that the project is dead?
Gather: screenshots of the abandoned website or socials, on-chain proof of liquidity removal, and possibly a burn transaction of your own tokens. Sell whatever is sellable to make the realisation concrete.

Does this also apply to pre-2026 thefts?
No. Theft before 1 January 2026 falls under the old regime (normal management = not deductible, except for speculative or professional situations). The 10% regime does not work retroactively.

What if I am a professional trader?
Then the loss qualifies as a business loss under progressive rates, and is in principle carryable forward to subsequent years. Read our guide on professional crypto tax.

🚀 Cryptotax helps you build your case file

Cryptotax automatically detects suspicious outgoing transfers and lets you label transactions as "theft", "lost" or "rugpull". Your export report then clearly states the net result, with the loss events listed separately, ready for your tax return or for your accountant.

Want to know which transactions in your wallets might be flagged as suspicious? Run the free scan and review your case file before you go to the police or the tax authority.

⚠️ Disclaimer: This article is purely informational and not individual tax advice. The definitive declaration codes for theft losses are published by FOD Financiën (the Belgian tax authority) before May 2027. For specific cases (especially with large amounts or borderline situations): consult a certified Belgian tax adviser or request a ruling from the Office for Advance Tax Rulings (Dienst Voorafgaande Beslissingen).