David Rotfleisch on the Coldcard Hack: What Bitcoin Holders & the Canadian Company Coinkite Face at Tax Time

The $40 Million Coldcard Exploit

On July 31, 2026, the bitcoin and crypto community woke up to news that attackers had drained roughly 600 bitcoin, worth close to US$40 million, from several hundred Coldcard hardware wallets in a matter of minutes. Coldcard is a bitcoin-only hardware wallet built by Coinkite, a Canadian technology company that has spent years marketing the device as one of the most security-conscious ways to hold bitcoin outside an exchange.

The cause, according to Coinkite’s own disclosure, was a firmware bug in certain Coldcard Mk3 devices running firmware version 4.0.1 or later. Instead of drawing on a true hardware randomness source, affected devices generated wallet seeds using predictable chip data, a flaw security researchers at Jack Dorsey’s Block traced back to a firmware change made in March 2021. Attackers who identified the pattern were able to reconstruct private keys and sweep funds from roughly 500 single-signature wallets before most owners had any idea something was wrong. Because seeds can be exported between devices, the exposure was never limited to Coldcard hardware itself; any wallet that imported an affected seed inherited the same vulnerability.

Coinkite has since released fixed firmware and is urging every affected user to generate an entirely new wallet and migrate their funds, since updating the firmware alone does not repair a seed that was already compromised. The incident has reignited a broader industry debate about the real-world risks of self-custody, given that the entire premise of a hardware wallet is that the owner, not an exchange or custodian, controls the private keys.

What has received far less attention is the tax position of the people and the company on either side of this story. This article looks at both.

Canadian Tax Treatment for Bitcoin Holders Who Lost Money

Canada’s Income Tax Act does not treat cryptocurrency as currency. It is property, and a disposition of that property, whether by sale, gift, or involuntary loss such as theft, can trigger a capital gain, a capital loss, business income, or a business loss depending on how the taxpayer held and used it.

The Coldcard theft was involuntary, which raises the first hurdle for any victim: a capital loss requires a disposition to have actually occurred. The CRA’s administrative guidance on losses from crime, in Income Tax Folio S3-F9-C1, treats losses through theft by strangers as an inherent risk of carrying on most businesses, and confirms such losses are normally deductible where reasonably incidental to the taxpayer’s income-earning activities, but only out-of-pocket losses qualify. A Coldcard victim needs to be able to show that the stolen bitcoin has genuinely left their control, that recovery is unlikely, and that they hold the wallet records and transaction history to support that.

Whether the loss lands on the capital account or the income account then depends on why the taxpayer held the bitcoin in the first place. A long-term holder will generally realize a capital loss under section 40 of the Income Tax Act, deductible only against capital gains. A taxpayer whose crypto holdings amount to inventory of a trading business, judged by the frequency of transactions, the taxpayer’s intention, and the other badges of trade the Tax Court of Canada looks to, may instead realize a fully deductible business loss.

The tax deduction is based on cost, not on what the bitcoin was worth when it was stolen

This is the point most victims get wrong. The deductible loss is not measured by the bitcoin’s value on the day of the hack. It is measured by the taxpayer’s adjusted cost base, what they actually paid, minus the proceeds of disposition, which are generally nil absent compensation.

Two taxpayers who lost the exact same coin on the exact same day illustrate how differently this can play out.

Taxpayer A bought 1 bitcoin for US$30,000 several years ago. Taxpayer B bought 1 bitcoin for US$80,000, closer to bitcoin’s prior high. At the time of the July 31 hack, bitcoin was trading in the US$58,000 to US$60,000 range, so both taxpayers lost a coin worth roughly US$60,000. That figure is irrelevant to the tax calculation. Taxpayer A’s capital loss is US$30,000, an allowable capital loss of US$15,000. Taxpayer B’s capital loss is US$80,000, an allowable capital loss of US$40,000, two and a half times larger, purely because of what Taxpayer B originally paid. If either taxpayer’s bitcoin were business inventory rather than an investment, the same cost-based figures would be fully deductible against any source of income instead of only half.

There is also a currency wrinkle. Those US dollar figures need to be converted into Canadian dollars for a Canadian return, generally using the Bank of Canada’s exchange rate in effect on the relevant transaction date. Because the purchase and the theft happened on different dates, two different exchange rates are usually involved: one for the adjusted cost base at the time of purchase, and a separate one for the date the loss is considered to occur.

Where Coinkite, an insurer, or another party later compensates a victim, section 54 of the Income Tax Act treats that compensation as proceeds of disposition, and subsection 44(2) governs the timing. A taxpayer who uses that compensation to acquire replacement property within the time limits in subsection 44(1) may be able to defer some or all of the resulting gain instead of realizing a loss.

Tax Implications for Coinkite, the Canadian Company

Coinkite’s position is a different tax question entirely. As a Canadian resident corporation, Coinkite is taxed on its worldwide income, and anything it spends or loses in connection with this incident falls under the ordinary business-expense and business-loss rules rather than the capital-gains regime that governs an individual investor’s bitcoin.

If Coinkite reimburses affected customers, whether out of contractual obligation, reputational necessity, or simple goodwill, those payments are generally deductible as a current business expense where they protect the company’s ongoing business and preserve customer goodwill rather than acquire a capital asset. Canadian crypto tax authorities and courts have long accepted that payments made to protect a business’s reputation and customer relationships, even absent a strict legal obligation to pay, can qualify as ordinary deductible expenses.

If the company carries cyber-insurance or product-liability coverage and receives proceeds under it, those proceeds are generally taxable, since they offset an otherwise deductible loss or expense. Legal fees defending claims or negotiating settlements with affected customers are typically deductible as well, provided they relate to the ordinary conduct of the business rather than a capital transaction. To the extent the incident produces a net loss for the year, Coinkite can generally treat it as a non-capital loss, carried back three years and forward twenty, giving the company real flexibility to offset the cost of a security incident against other years’ income.

Pro Tax Tips: What Should a Coldcard Victim Actually Do Before Filing?

• The instinct after losing bitcoin to a hack like this is to file a loss claim immediately. That instinct should be resisted until the taxpayer has actually confirmed, and documented, that the funds are gone and unlikely to be recovered, since the CRA generally requires evidence that a disposition has occurred before it will accept the claim.
• In practice, that means holding onto the original purchase receipts establishing adjusted cost base, the wallet addresses and on-chain transaction records showing the unauthorized transfer, and any public statements from Coinkite or independent security researchers confirming the exploit and which firmware versions were affected.
• Taxpayers who are unsure whether their bitcoin holdings should be treated as capital property or as business inventory should work through the badges-of-trade factors, since that determination alone can double the size of the eventual deduction. And anyone who later receives a compensation payment, an insurance payout, or a partial recovery after already claiming a loss needs to revisit that earlier filing, since the recovered amount may reduce the loss claimed or may need to be reported as income.
• Given how quickly the facts of an incident like this can develop, and how much turns on cost basis, currency conversion, and characterization, taxpayers and companies dealing with a crypto theft loss are well advised to consult a crypto tax lawyer in Canada before filing rather than after.

Frequently Asked Questions (FAQs)

Is my Coldcard loss deduction based on what my bitcoin was worth when it was stolen?

No. It is based on your adjusted cost base, what you actually paid, not the bitcoin’s fair market value on the day of the hack. Two taxpayers who lost identically valued bitcoin on the same day can end up with very different deductions depending on what each originally paid.

Can I claim a tax loss right away, or do I need to wait?

Generally, you need to wait until it is clear that a disposition has occurred, meaning ownership has been legally extinguished, abandoned, or otherwise given up, and that recovery is unlikely. The CRA does not treat a hack as an automatic deductible loss the moment it happens.

What happens if Coinkite compensates me for my stolen bitcoin?

Compensation is treated as proceeds of disposition under section 54 of the Income Tax Act. If you use it to acquire replacement bitcoin within the time limits in subsection 44(1), you may be able to defer some or all of the resulting gain rather than realizing a loss.

Can Coinkite deduct the cost of reimbursing customers or defending claims connected to this hack?

Generally, yes. Reimbursements made to protect customer goodwill and legal fees connected to the incident are typically deductible as current business expenses, and any resulting net loss for the year can generally be treated as a non-capital loss, carried back three years and forward twenty.

Do I need to convert the US dollar bitcoin prices into Canadian dollars myself?

Yes. The CRA requires Canadian-dollar reporting, using the exchange rate in effect on the relevant transaction date, generally the Bank of Canada’s rate. The purchase date and the loss date usually call for two different exchange rates, not one.

Disclaimer: This article just provides broad information. It is only up to date as of the posting date. It has not been updated and may be out of date. It does not give legal advice and should not be relied on. Every tax scenario is unique to its circumstances and will differ from the instances described in the articles. If you have specific legal questions, you should seek the advice of a Canadian tax lawyer.

Stay informed with the latest legal developments at Global Law Experts.