If company bitcoin is lost or stolen

Sources checked 10 November 2026. This page is a calm checklist for a bad day, plus how the tax rules treat lost keys and theft. It is not legal, tax or security advice and not a recommendation to buy, sell or hold bitcoin. In a live incident, speak to your lawyer, accountant and insurer early. If anything here conflicts with a linked source, the source wins.

Work out what happened

The first hours

1. Stop and check. Pause any scheduled withdrawals and sends. Check the balance on a watch-only wallet or your own node rather than a link someone sent you.
2. Secure what is left. If a key may be compromised but the funds are still there, two remaining keyholders move them to a freshly created wallet, verified on the signing devices, after a test transaction. Do not rush this into a new mistake. See sending bitcoin safely.
3. Lock accounts. Change passwords and two-factor settings on provider, email and accounting accounts, and remove any withdrawal address that should not be there.
4. Preserve evidence. Record transaction IDs, addresses, times, emails, chat messages and screenshots. Write down who did what, and when, while it is fresh. Do not wipe devices that may hold evidence.
5. Tell the board. Minute what happened, what has been done and who is leading. See directors' duties.
6. Ignore recovery offers. Victims are often contacted by people claiming they can trace and recover bitcoin for an upfront fee. The FBI has warned about fake recovery companies and fictitious law firms.

Source: FBI IC3: PSA230811: companies falsely claiming an ability to recover funds lost in cryptocurrency scams, FBI IC3: PSA240624: fictitious law firms targeting cryptocurrency scam victims.

Choose your country for reporting and tax.

UK: reporting

Report fraud and cyber crime to Report Fraud, run by the City of London Police, which replaced Action Fraud from 4 December 2025. In Scotland, report to Police Scotland on 101. Tell any provider involved, the company's insurer under the policy's notice terms and the company's accountant.

Source: Report Fraud (City of London Police): Report Fraud: the place to report cyber crime and fraud (in Scotland, report via 101), GOV.UK: Report Fraud: new service from City of London Police, replacing Action Fraud from 4 December 2025.

UK: Corporation Tax on lost keys and theft

HMRC says that misplacing a private key does not count as a disposal, because the key and the tokens still exist. If it can be shown there is no prospect of recovering the key or accessing the tokens, a negligible value claim could be made; if HMRC accepts it, the company is treated as having disposed of and reacquired the tokens, which can crystallise a loss.

Source: HMRC: Cryptoassets Manual CRYPTO41500: losing private keys.

Section 24 of the Taxation of Chargeable Gains Act 1992 allows a negligible value claim to treat the asset as sold and immediately reacquired at the value stated in the claim. For Corporation Tax, the claim can specify an earlier time on or after the first day of the earliest accounting period ending not more than two years before the claim, if the asset was already of negligible value then. HMRC says that because exchange tokens are pooled, the claim needs to be made for the whole pool, not individual tokens. Our judgement, not a rule: where only part of a company's holding is lost, how that works in practice is a question for the accountant.

Source: legislation.gov.uk: Taxation of Chargeable Gains Act 1992, section 24: assets lost or destroyed, or of negligible value, HMRC: Cryptoassets Manual CRYPTO41450: S24 and negligible value (claims for the whole pool).

Theft is treated differently. HMRC does not consider theft to be a disposal, as the owner still owns the stolen asset and has a right to recover it, so victims of theft cannot claim a loss for Corporation Tax. Allowable losses generally must be reported to HMRC before they can be used.

Source: HMRC: Cryptoassets Manual CRYPTO41550: being defrauded (theft is not a disposal), HMRC: Cryptoassets Manual CRYPTO41400: Corporation Tax on chargeable gains, capital losses.

See company bitcoin tax and the year end and CT600 for how losses go on the return.

US: reporting

The FBI asks victims of cryptocurrency fraud to report to its Internet Crime Complaint Center, IC3, with as much transaction detail as possible. Tell any provider involved, the insurer under the policy's notice terms and the company's accountant.

Source: FBI IC3: Cryptocurrency fraud: how to report it.

US: theft losses for a corporation

Section 165(a) allows a deduction for any loss sustained during the taxable year and not compensated for by insurance or otherwise, measured from adjusted basis. The dollar limits and the 10 percent of income limit in section 165(h) apply to personal casualty losses of individuals, not to a corporation. Section 165(e) treats a theft loss as sustained in the taxable year in which the taxpayer discovers it.

Source: govinfo (US Code): 26 U.S.C. 165: losses, including (e) theft losses treated as sustained in the year of discovery.

Treas. Reg. 1.165-8 repeats that a theft loss is not deductible for the year the theft occurs unless that is also the year it is discovered. Treas. Reg. 1.165-1(d) adds that where there is a claim for reimbursement with a reasonable prospect of recovery, such as an insurance claim or a claim against a provider, no part of the loss covered by that claim is sustained until it can be ascertained with reasonable certainty whether the reimbursement will be received, for example by settlement, adjudication or abandonment of the claim.

Source: eCFR: Treas. Reg. 1.165-8: theft losses, eCFR: Treas. Reg. 1.165-1(d): year of deduction and a claim with a reasonable prospect of recovery.

Our judgement, not a rule: lost keys with no theft are harder under the US rules, because the loss must be fixed by identifiable events. Keep the evidence of what happened and when, and take advice before claiming. See bitcoin for US C corporations.

The weeks after

• Write a short incident report: what happened, the timeline, the amounts, what was recovered and what changes.
• Agree with the accountant how the loss is reflected in the accounts and the tax return for the period. See bookkeeping examples.
• Rebuild the wallet with new keys and a new key ceremony, and update the key register and backups. See key ceremony.
• Run a recovery drill on the new setup. See recovery drill.
• Review the policy: approvals, address checks, who can add withdrawal addresses, and what the insurer requires.

Prepare before it happens

• A one-page incident plan with names, phone numbers and the reporting links above, stored where keyholders can reach it without the company laptop.
• A watch-only wallet so anyone on the board can check the balance without a signing device.
• A key register showing where each key and backup lives, kept apart from the keys themselves.
• Insurance terms read in advance, including notice periods. See rules and insurance.

Common questions

We lost one key. Has the company lost bitcoin?

Not with a 2 of 3 multisig and the other two keys and the wallet configuration intact. It has lost its margin for error, which is why moving to a new wallet promptly matters.

Can a company claim a UK tax loss for stolen bitcoin?

HMRC says not for the theft itself, because the company still owns the asset and has a right to recover it. Take advice on the facts.

Can stolen bitcoin be traced?

Transactions are public, so movements can be followed, and law enforcement and exchanges sometimes freeze funds. Be wary of anyone promising recovery for a fee.

Common mistakes

• Treating one lost key as a lost wallet, or as nothing to act on.
• Moving funds in a panic to an address that has not been checked on the signing devices.
• Paying a recovery service upfront.
• Missing the insurer's notice deadline.
• Claiming a theft loss in the wrong year, or while an insurance claim is still open.

Read next

• 2 of 3 multisig, what one lost or stolen key means.
• Scams targeting companies, how most losses start.
• Security lessons, what past incidents teach.
• Recovery drill, test the plan before you need it.
• Continuity, when a keyholder leaves or cannot act.
• Company bitcoin tax, gains, losses and records.

Sources

Primary sources only. Each link was checked on 10 November 2026. Rules change, so confirm the current version with your adviser.

1. FBI IC3PSA230811: companies falsely claiming an ability to recover funds lost in cryptocurrency scams
2. FBI IC3PSA240624: fictitious law firms targeting cryptocurrency scam victims
3. Report Fraud (City of London Police)Report Fraud: the place to report cyber crime and fraud (in Scotland, report via 101)
4. GOV.UKReport Fraud: new service from City of London Police, replacing Action Fraud from 4 December 2025
5. HMRCCryptoassets Manual CRYPTO41500: losing private keys
6. legislation.gov.ukTaxation of Chargeable Gains Act 1992, section 24: assets lost or destroyed, or of negligible value
7. HMRCCryptoassets Manual CRYPTO41450: S24 and negligible value (claims for the whole pool)
8. HMRCCryptoassets Manual CRYPTO41550: being defrauded (theft is not a disposal)
9. HMRCCryptoassets Manual CRYPTO41400: Corporation Tax on chargeable gains, capital losses
10. FBI IC3Cryptocurrency fraud: how to report it
11. govinfo (US Code)26 U.S.C. 165: losses, including (e) theft losses treated as sustained in the year of discovery
12. eCFRTreas. Reg. 1.165-8: theft losses
13. eCFRTreas. Reg. 1.165-1(d): year of deduction and a claim with a reasonable prospect of recovery