Coldcard Hardware Wallet Attack: Canadian Tax Implications for Bitcoin Holders Who Lost Funds and for the Canadian Company Behind the Wallet

Overview: The Coldcard Hack and Why It Matters for Canadian Crypto Taxpayers

Bitcoin holders around the world woke up on July 31, 2026, to unsettling news: attackers had drained roughly 600 bitcoin, worth close to $40 million, from several hundred Coldcard hardware wallets in a matter of minutes. Coldcard is a bitcoin-only hardware wallet built by Coinkite, a Canadian technology company. The theft was traced to a firmware bug that generated predictable, rather than truly random, private keys on certain Coldcard devices going back to 2021.

For the Canadian taxpayers whose bitcoin disappeared overnight, and for the Canadian company whose product made headlines for the wrong reason, this incident raises a set of tax questions that go well beyond the immediate financial shock:

• Can a victim of a hardware wallet hack or self-custody exploit claim a tax loss?
• Is that loss a capital loss or a business loss? 
• What happens tax-wise if Coinkite offers compensation? 
• And what are the corporate tax consequences for a Canadian company whose product is linked to a multimillion-dollar theft?

This article uses the Coldcard incident to walk through how the Canada Revenue Agency (CRA) treats stolen cryptocurrency, both for individual holders and for the Canadian corporation on the other side of the story.

Background: What Happened to Coldcard and How the CRA Views Cryptocurrency

According to Coinkite's own disclosure, the vulnerability affected Coldcard Mk3 devices running firmware version 4.0.1 or later, where seed generation relied in part on predictable chip data instead of a robust randomness source. Attackers who identified the pattern were able to reconstruct private keys and sweep funds from roughly 500 wallets before most owners knew anything was wrong. Because seeds can be exported between wallets, the exposure was not limited to Coldcard devices themselves; any wallet that imported an affected seed inherited the same vulnerability.

For Canadian tax purposes, none of that changes the starting point: the CRA treats cryptocurrency as a form of property, not as currency, and losses involving cryptocurrency transactions are generally treated as either business losses or capital losses. A disposition of that property, whether by sale, exchange, gift, or involuntary loss, can trigger a capital gain, a capital loss, business income, or a business loss, depending on how the taxpayer held and used the crypto asset.

The Coldcard incident has reignited a broader debate over the risks of self-custody, since the entire selling point of a hardware wallet is that a taxpayer, not an exchange or custodian, controls their own private keys. Where the Coldcard incident differs from an ordinary sale is that the taxpayer never chose to part with the bitcoin. That distinction between a voluntary disposition and an involuntary one, caused here by theft, drives most of the tax analysis that follows.

Key Issues and Findings: How the Income Tax Act Treats Stolen Cryptocurrency

Individual holders: capital loss or business loss

Whether a Coldcard victim's loss is a capital loss or a business loss depends on why the taxpayer held the bitcoin in the first place. A taxpayer who bought and held bitcoin as a long-term investment will generally realize a capital loss under section 40 of the Income Tax Act. A taxpayer whose crypto holdings amount to inventory of a trading business, because of the frequency of transactions, the taxpayer's intention, or other badges of trade the CRA and the Tax Court of Canada look to, may instead realize a fully deductible business loss.

The CRA's administrative guidance on losses from crime, set out in Income Tax Folio S3-F9-C1, is directly relevant here. That guidance confirms that losses through theft by strangers are treated as an inherent risk of carrying on most businesses, and that such losses are normally deductible where they are reasonably incidental to the taxpayer's income-earning activities. The same folio makes clear that only out-of-pocket losses qualify. A taxpayer cannot deduct profits that were merely hoped for or projected.

Establishing that a disposition actually occurred

A capital loss requires a disposition, and CRA's administrative position has generally treated theft, hacking, or an exploit like the Coldcard bug as not automatically producing a deductible loss. Ownership needs to be legally extinguished, abandoned, or otherwise disposed of before the loss crystallizes. In practical terms, a Coldcard victim will want to be able to show that the stolen bitcoin has actually left their control on the blockchain, that recovery is unlikely, and that they hold the wallet records, transaction history, and cost-base documentation to support the claim if CRA asks questions later.

Calculating the loss: adjusted cost base, not the bitcoin's value at the time of the hack

A common misconception among Coldcard victims is that the deductible loss corresponds to what the stolen bitcoin was worth at the moment of the theft. It does not. Under section 40 of the Income Tax Act, a capital loss is calculated as the taxpayer's adjusted cost base, meaning what they actually paid to acquire the bitcoin, minus the proceeds of disposition, which are generally nil absent compensation. The bitcoin's fair market value on the day of the hack does not enter the calculation at all.

Two examples show how differently this plays out depending on when the taxpayer bought their bitcoin, even though both taxpayers lost the exact same coin on the exact same day.

• Example 1: bought at $30,000. Taxpayer A bought 1 bitcoin for $30,000 several years before the hack. On July 31, 2026, when the Coldcard exploit occurred, bitcoin was trading in the $58,000 to $60,000 range, so Taxpayer A's stolen bitcoin was worth roughly $60,000 at the time of the theft. That $60,000 figure is irrelevant to the tax calculation. Because Taxpayer A's adjusted cost base was $30,000 and, assuming no compensation is ever received, the proceeds of disposition are nil, the capital loss is $30,000. Only half of that, an allowable capital loss of $15,000, can be used to offset Taxpayer A's capital gains.
• Example 2: bought at $80,000. Taxpayer B bought 1 bitcoin for $80,000, closer to bitcoin's prior high, before the price pulled back. At the same July 31, 2026 hack, that coin was also worth around $60,000, meaning Taxpayer B was already sitting on an unrealized loss even before the theft happened. Taxpayer B's adjusted cost base was $80,000, so the capital loss on the stolen bitcoin is $80,000, and the allowable capital loss is $40,000.

One further wrinkle: bitcoin prices, including the $30,000, $80,000, and $60,000 figures used above, are typically quoted in US dollars, but the CRA requires everything on a Canadian tax return to be reported in Canadian dollars. That means each of those US dollar figures has to be converted to its Canadian dollar equivalent using the exchange rate in effect on the relevant transaction date, generally the Bank of Canada's daily exchange rate, or an average rate for the period if that is more appropriate to the taxpayer's circumstances. The Income Tax Act's spot-rate conversion requirement under section 261 governs exactly this kind of conversion. 

Critically, the purchase and the theft happened on different dates, so two different exchange rates are usually involved: the adjusted cost base is converted at the USD/CAD rate in effect when the bitcoin was originally purchased, while any proceeds of disposition, or the date the loss is considered to occur, are converted at the rate in effect on that later date. A taxpayer who simply plugs the US dollar purchase price into their Canadian return without converting it will misstate both their adjusted cost base and the resulting loss.

Both examples hold the bitcoin's fair market value at the time of the hack constant, at roughly $60,000, yet Taxpayer B ends up with an allowable capital loss two and a half times the size of Taxpayer A's, purely because of what each taxpayer originally paid. Taxpayers who assume their loss is measured by what the bitcoin was worth on the day of the exploit, rather than by their own cost, risk under or over-claiming the deduction, so establishing the correct adjusted cost base, in Canadian dollars, is one of the first steps after confirming that a disposition has occurred.

The same cost-based principle applies where the loss is a business loss rather than a capital loss, meaning the taxpayer's crypto holdings are inventory of a trading business rather than a long-term investment. The deduction is still measured against the taxpayer's cost, not the bitcoin's market value at the time of the theft, but on income account the full amount of the loss is deductible against any source of income, not just half.

Using the same two taxpayers: if Taxpayer A's bitcoin was inventory of a trading business rather than an investment, the $30,000 cost is fully deductible as a business loss, a $30,000 deduction against any source of income, double the $15,000 allowable capital loss available on capital account. Taxpayer B's $80,000 cost would likewise be fully deductible as a business loss, an $80,000 deduction, double the $40,000 allowable capital loss on capital account. In neither case does the bitcoin's roughly $60,000 value at the time of the hack factor into the calculation. The only thing that changes between the capital account and income account versions of these examples is how much of the same cost-based loss is deductible, half or all of it, not the size of the underlying loss itself.

This is also why the capital-versus-business characterization discussed above matters so much in practical terms. Two taxpayers who bought bitcoin at identical prices and lost it in the identical hack can end up with deductions that differ by tens of thousands of dollars, depending purely on whether their trading pattern and intentions support treating the loss as business income rather than capital.

Compensation, insurance proceeds, and deferral of gains

Section 54 of the Income Tax Act defines proceeds of disposition to include compensation for property unlawfully taken and amounts received under an insurance policy on stolen property. If Coinkite, an insurer, or another party compensates a Coldcard victim for the stolen bitcoin, that compensation is treated as proceeds of disposition, and the timing rules in subsection 44(2) determine when the disposition is considered to occur.

Where a taxpayer receives that kind of compensation and uses it to acquire replacement property within the time limits set out in subsection 44(1), generally by the end of the second taxation year following the year of the loss, the taxpayer may be able to elect to defer some or all of the resulting capital gain. If no compensation is ever received, the taxpayer is left with a capital loss rather than a deferral question.

Recovered funds

Where law enforcement or the company later recovers some of the stolen bitcoin, or where a Coldcard victim receives a partial goodwill payment, that recovery can reduce a previously claimed loss, or it may need to be included in income if a deduction was already allowed. Taxpayers who claim a loss in one year and later recover funds in a subsequent year should expect to revisit their filing.

Tax implications for Coinkite as a Canadian company

Coinkite's position differs from that of its customers. As a Canadian resident corporation, Coinkite is subject to Canadian tax on its worldwide income, and any losses or expenses connected to the Coldcard incident are analyzed under the ordinary business-expense and business-loss rules rather than the capital-gains regime that applies to an individual investor's bitcoin.

If Coinkite chooses to reimburse affected customers, whether out of contractual obligation, reputational necessity, or simple goodwill, those payments are generally deductible as a current business expense where they are made to protect the company's ongoing business and preserve customer goodwill, rather than to acquire a capital asset. The CRA and the courts have long accepted that payments made to protect a business's reputation and customer relationships, even where there is no strict legal obligation to pay, can qualify as ordinary deductible expenses rather than capital outlays.

If Coinkite carries cyber-insurance or product-liability insurance and receives proceeds under that coverage, those proceeds are generally taxable to the company as they offset a deductible loss or expense, similar to how insurance proceeds are treated for other Canadian businesses that experience theft or property loss. Legal fees incurred defending claims or negotiating settlements with affected customers are typically deductible as well, provided they relate to the ordinary conduct of the business rather than to a capital transaction such as a share sale.

Finally, to the extent the incident results in a net loss for the year, whether from reimbursements, legal costs, or lost business, Coinkite can generally treat this as a non-capital loss. Non-capital losses can be carried back three years and forward twenty years, which gives a Canadian company facing a costly security incident meaningful flexibility to offset the loss against other years' income.

Implications for Canadian Taxpayers

For individual Coldcard holders in Canada, the immediate practical question is documentation. Before claiming any loss, a taxpayer should gather the original purchase records establishing the adjusted cost base of the stolen bitcoin, on-chain records showing the unauthorized transfer, any communication from Coinkite or blockchain security researchers confirming the exploit, and records of any partial recovery or compensation received. Taxpayers should also consider whether their crypto activity, viewed as a whole, looks more like an investment or more like a trading business, since that determination decides whether the eventual loss is a capital loss, deductible only against capital gains, or a business loss, deductible against any source of income.

For a Canadian company in Coinkite's position, the tax analysis runs alongside a broader set of legal and reputational considerations, but the underlying tax questions, deductibility of reimbursements, treatment of insurance recoveries, and non-capital loss carryovers, are ones that any Canadian technology company should plan for before a security incident happens, not after.

“When a product failure or exploit forces a Canadian company to compensate customers, the tax treatment of those payments often gets decided by how the company frames and documents the expense at the time, not months later during a CRA audit,” says David J. Rotfleisch, founding tax lawyer at Rotfleisch & Samulovitch P.C. “The same is true for individual holders. The taxpayers who fare best in front of the CRA are the ones who preserved their wallet records and cost-base documentation long before anything went wrong.”

Takeaway: Documentation Decides Whether a Crypto-Theft Loss Survives a CRA Audit

The Coldcard incident is a reminder that a stolen cryptocurrency loss is not automatically deductible just because the taxpayer's bitcoin is gone. Individual holders need to establish that a disposition has actually occurred, characterize their holding as capital property or business inventory, and be ready to account for any compensation they receive. Canadian companies whose products or platforms are implicated in a hack face a parallel but distinct set of questions around the deductibility of customer reimbursements, the taxability of insurance proceeds, and the use of non-capital losses. In both cases, careful record-keeping before, during, and after the incident is what ultimately determines whether a loss claim holds up.

Top Tax Tips

• Canadian taxpayers who held bitcoin on an affected Coldcard device should resist the urge to file an immediate loss claim without first confirming, and documenting, that the funds are genuinely gone and unlikely to be recovered, since the CRA generally requires evidence that a disposition has actually taken place before it will accept a capital or business loss. 
• It is worth keeping every piece of contemporaneous evidence available, including the original purchase receipts that establish adjusted cost base, wallet addresses, on-chain transaction records showing the unauthorized transfer, and any public statements from Coinkite or independent security researchers confirming the exploit and the affected firmware versions. 
• Taxpayers who are unsure whether their crypto holdings should be treated as capital property or as inventory of a business should work through the CRA's badges-of-trade factors, including transaction frequency, holding period, and their own intentions at the time of purchase, since that determination decides whether the eventual loss is only half deductible against capital gains or fully deductible against any source of income. Anyone who receives a compensation payment, an insurance payout, or a partial recovery after claiming a loss should revisit their earlier filing, since that amount may reduce the loss already claimed or may need to be reported as income. 
• Canadian businesses in Coinkite's position should document, in real time, the business purpose behind any customer reimbursement or goodwill payment, since a well-documented decision to protect ongoing customer relationships supports treating the payment as a deductible current expense rather than risking a dispute with the CRA over its characterization. 
• Given how quickly the facts, and the applicable CRA guidance, can shift in a case like this, taxpayers and companies dealing with a crypto theft loss should seek the advice of a cryptocurrency tax lawyer in Canada before filing.

FAQs

Do I need to convert US dollar bitcoin prices into Canadian dollars for my tax return?

Yes. Bitcoin prices are typically quoted in US dollars, but the CRA requires amounts on a Canadian tax return to be reported in Canadian dollars. The adjusted cost base is converted using the exchange rate in effect on the date the bitcoin was purchased, and any proceeds or the loss itself are converted using the exchange rate in effect on the date of the disposition, which are usually two different dates and two different rates.

Is my tax deduction based on what my bitcoin was worth when it was stolen, or what I paid for it?

It is based on what you paid, your adjusted cost base, not the bitcoin's fair market value on the day of the hack. A taxpayer who bought bitcoin at $30,000 and a taxpayer who bought the same amount of bitcoin at $80,000 will have very different deductible losses even if the coin was worth the same amount, around $60,000, when it was stolen.

Can I claim a tax loss for bitcoin stolen from my Coldcard wallet?

Possibly, but only once you can show that a disposition has occurred, meaning the bitcoin has genuinely left your control and recovery is unlikely. The CRA does not automatically treat a hack or theft as a deductible loss the moment it happens.

Is stolen cryptocurrency treated as a capital loss or a business loss in Canada?

It depends on how you held the crypto. Long-term investors generally realize a capital loss, deductible only against capital gains. Taxpayers whose crypto activity amounts to a business may realize a fully deductible business loss instead.

What documentation do I need to support a stolen crypto loss claim with the CRA?

Purchase records establishing your adjusted cost base, wallet addresses, on-chain transaction records showing the unauthorized transfer, and any confirmation from the wallet manufacturer or security researchers of the exploit.

Do I need to wait before claiming a loss on stolen bitcoin?

Generally, yes. CRA's administrative position requires that ownership be legally extinguished, abandoned, or otherwise disposed of before a loss crystallizes, so taxpayers often need to wait until recovery appears unlikely.

What happens if Coinkite compensates me for my stolen bitcoin?

Compensation is treated as proceeds of disposition under section 54 of the Income Tax Act. If you use it to acquire replacement property within the time limits in subsection 44(1), you may be able to defer some or all of the resulting gain.

Are insurance proceeds for stolen cryptocurrency taxable in Canada?

For a business, insurance proceeds connected to stolen crypto or other stolen property are generally taxable, since they offset an otherwise deductible loss. For an individual, insurance proceeds are treated as proceeds of disposition of the stolen property.

Can a Canadian company like Coinkite deduct losses connected to a hack?

Yes, in general. Reimbursements made to protect customer goodwill, legal fees connected to the incident, and other related costs are typically deductible as current business expenses, and any resulting net loss can generally be treated as a non-capital loss.

How long can a non-capital loss from a business hack be carried forward in Canada?

Non-capital losses can generally be carried back three years and carried forward twenty years, giving a Canadian company flexibility to offset the loss against other years' income.

How long can an individual's capital loss from stolen crypto be carried forward?

Net capital losses can be carried forward indefinitely and carried back up to three years, though they can only offset capital gains, not other types of income.

Is my hardware wallet or self-custodied bitcoin insured against theft?

Generally not automatically. Hardware wallet manufacturers, including Coinkite, typically do not provide blanket insurance coverage for coins lost to a device or firmware flaw, so any compensation is usually discretionary rather than a policy payout. That distinction matters for tax purposes, since a discretionary goodwill payment and a formal insurance payout can be characterized differently.

Does the CRA audit claims for stolen cryptocurrency?

Yes. Crypto-related losses attract CRA scrutiny, particularly where the amounts are significant, so taxpayers should expect to substantiate both the loss itself and their cost base with clear documentation.

What if I only recover part of my stolen bitcoin later?

A partial recovery generally reduces a previously claimed loss, or may need to be reported as income if a deduction was already allowed, so it is important to revisit your tax filing once any recovery occurs.

Should I get legal advice before filing a claim related to a crypto hack?

Given the fact-specific nature of the disposition and characterization questions involved, it is worth speaking with a Canadian tax lawyer before filing, particularly where significant amounts are at stake.

DISCLAIMER: This article provides broad information. It is only accurate as of the posting date. It has not been updated and may be out-of-date. It does not give legal advice and should not be relied on as tax advice. Every tax scenario is unique to its circumstances and will differ from the instances described in the article. If you have specific legal questions, you should seek the advice of a Canadian tax lawyer.