Stolen Crypto, a Rushed Tax Claim, and What CRA Actually Allows

The situation

Ifrah ran a small marketing and design corporation out of Guelph, work she balanced alongside a day job as an office manager. Her spouse, Hodan, worked as an insurance adjuster and held the other half of the company's shares. Over several years the corporation had built up retained earnings — profit left inside the company rather than paid out as salary or dividends — and in a good year the two of them decided to put roughly $110,000 of that cash into cryptocurrency, mostly as a longer-term store of value rather than anything the company actively traded.

The funds sat in a wallet connected to an exchange account that the corporation's bookkeeper, Khalil, had set up. About eighteen months later, a phishing email convinced Ifrah to enter her wallet credentials into a fake login page. Within an hour, roughly $82,000 of the holding had been moved out to an address neither of them controlled. The remaining balance was untouched only because Ifrah noticed unusual activity and locked down the account before more could be drained.

The theft itself was resolved quickly in the sense that matters most for a small business: it was over. What followed took much longer to untangle, because the loss had to travel through the corporation's books and tax return before its true cost could even be measured.

The problem

Khalil prepared the corporation's tax return for that year and deducted the full $82,000 as a business loss, the same way the company would deduct a bad debt or a piece of equipment that broke down. On paper it worked: the deduction reduced the corporation's taxable income and cut its tax bill by roughly $10,000. Ifrah and Hodan treated the matter as closed.

About ten months later, the Canada Revenue Agency sent a review letter asking for documentation supporting the loss. This was not a full audit, but a routine check triggered by an unusually large deduction relative to the corporation's normal expenses. Khalil sent CRA a short letter describing the hack and a printout of the wallet's transaction history. CRA's reviewer wrote back proposing to disallow the deduction entirely, on the basis that there was no supporting evidence the loss was real, permanent, or properly characterized. Ifrah called our office two weeks before the deadline to respond.

The documentation gap was fixable. The bigger problem was the characterization itself. Cryptocurrency held by a corporation as a long-term holding — the way this company held it — is generally treated as capital property for tax purposes, similar to shares or land, not as inventory or a routine business expense. A loss on capital property is a capital loss, and capital losses are only half deductible, and only against capital gains, not against ordinary business income. Khalil had claimed the loss as if it were a full, immediate deduction against operating income. Under the correct characterization, the company could claim only half the loss, and only if it had capital gains that year to absorb it. It had none.

What we did

1. Reviewed how the crypto had actually been used. Characterization depends on the facts, not on what a business would prefer. The corporation had never bought or sold cryptocurrency as part of its ordinary activity, had made no other digital-asset transactions, and had described the holding internally as a reserve. That pattern pointed clearly to capital property rather than inventory of a trading business, and no honest reading of the facts supported the deduction as originally filed.
2. Built the evidentiary record CRA actually needed. A theft loss has to be established with reasonable certainty in the year it is claimed. We helped the corporation assemble a police report filed promptly after the phishing incident, the exchange's own fraud-confirmation correspondence, wallet transaction records showing the unauthorized transfer, and a dated timeline showing when the funds became irretrievable rather than merely inaccessible. Ifrah and Hodan had most of this already; it had simply never been organized or sent to CRA.
3. Corrected the return rather than defending the original claim. We advised against arguing for the full deduction, since the underlying characterization was not defensible. Instead we responded to CRA with a corrected position: a capital loss of roughly $82,000, properly documented, with no capital gains in that year to offset it. That converted the loss into a net capital loss — not lost, but not usable immediately either.
4. Requested relief from penalties, not from the tax owing. Because the corporation had disclosed the loss on its original return, cooperated fully with the review, and corrected the error as soon as it was identified, we asked CRA to confirm no penalty would apply beyond the arrears interest that had accrued on the tax originally saved. CRA agreed, noting the original filing had been an error in characterization rather than an attempt to conceal anything.
5. Explained the ongoing value of the net capital loss. A net capital loss does not expire. It carries forward indefinitely and can be applied against capital gains the corporation realizes in any future year, including gains on other investments the company might hold later. We set out, in plain terms, how and when that carryforward could actually be used, so the loss was not written off twice — once by the hacker, once by a filing that assumed it was gone for good.

The outcome

CRA reassessed the corporation's return, disallowing the original business-loss deduction as filed. Because the corporation had no capital gains that year to absorb even the correctly characterized capital loss, none of the original $10,000 tax saving survived for that year — the loss was not erased, but its benefit was deferred rather than immediate. The corporation repaid the full $10,000 in tax it had saved by claiming the loss incorrectly, plus arrears interest of a little under $1,500 for the period the money had been treated as owed. No penalty was assessed.

Hodan's insurance background turned out to matter in a different way during this process. She checked the corporation's commercial insurance policy and confirmed what many businesses discover only after a loss like this: the policy's cyber-crime coverage excluded losses involving digital currency altogether. There was no insurance claim to fall back on. The tax treatment of the loss was the only recovery available, which made getting that treatment right — even after the fact — worth the effort it took.

The corporation's net capital loss of roughly $41,000 (half of the $82,000 loss, the deductible portion) remains available to offset capital gains in future years. It is a real asset on the company's tax position, just not one that could be cashed in immediately. Ifrah described the experience honestly: the theft itself was bad luck, but claiming it the wrong way turned a bad year into an expensive one, since the interest and the lost use of that $10,000 while the correction went through were costs that better advice from the outset would have avoided.

What you can learn from this