Throughout the year, many blockchains have been attacked by hackers. These loss events are indicators of the significant losses the cryptocurrency market has experienced.
For investors who have suffered, an important consideration is how to utilize these losses. Accordingly, this article will analyze the recent Solana hack in connection with the following tax strategies:
- Deducting capital and non-capital losses from theft; and
- Compensation for stolen or destroyed property.
To minimize losses, cryptocurrency investors should consider the availability of these tax strategies.
The Solana hack
In August 2022, Solana, the fifth-greatest blockchain based on total value locked, was subject to a cyber attack. Over 8,000 internet-connected “hot” wallets were compromised. The wallets affected were associated with major wallet providers, including Phantom, Slope and TrustWallet. As a result, users reported their funds being drained. Hours after the attack, Solana’s token, SOL, decreased by 4%.[1]
Solana crypto-addresses have been associated with the attack and have acquired at least USD$8 million in Solana-based tokens. The cause of the attack remains unclear, but engineers across several networks believe the issue is with the software of the hot wallets, rather than the Solana code. The attacker was able to initiate and approve transactions, suggesting a supply chain attack may have occurred. The attack has sparked conversation on the security implications of hot wallets connected to the internet versus cold wallets reliant on USB drives.[2]
Non-capital business losses from theft
Those who have had their cryptocurrency wallets and holdings affected due to the Solana hack may be able to claim losses. The Canada Revenue Agency (the “CRA”) has considered the potential for a scenario such as the Solana hack unfolding, and what it means for taxpayers falling victim to such an event.[3]
Income Tax Folio, S3-F9-C1, “Lottery Winnings, Miscellaneous Receipts and Income (and Losses) from Crime” (“IT S3-F9-C1”) provides guidance on the income tax treatment of losses of both a capital and non-capital nature occurring through theft or embezzlement.[4] Where there is a loss of trading assets, such as inventory or cash, the CRA takes the view that such losses are normally deductible in computing income from a business. Indeed, this is in line with the general principle under paragraph 18(1)(a) of the Income Tax Act (the “ITA”) that a business should be able to deduct expenses incurred in the ordinary course of earning business income.[5] However, the CRA is of the position that a loss of inventory due to theft is deductible in computing income from a business only if two conditions are met:
- The loss must constitute an inherent risk of carrying on the business; and
- The loss must be reasonably incidental to the normal income-earning activities of the business.[6]
These conditions could be satisfied where, for example, a taxpayer is carrying on business as a cryptocurrency trader or cryptocurrency exchange and owns Solana wallets which held cryptocurrency for customers or the taxpayer. Taxpayers carrying on business in this manner should be able to prove that the loss occurred due to theft, given that over USD$8 million was stolen during the Solana hack. The less certain issue is whether or not the taxpayer can meet the two requirements listed above.
According to the CRA, losses due to theft by strangers are an inherent risk for most businesses,[7] and should be deductible.[8] As the Solana tokens lost is likely the inventory of a business, it is arguable that the loss is reasonably incidental to the income-earning activities of the business. Therefore, a holder that held Solana wallets as inventory and had their inventory stolen during the Solana hack may be able to deduct their losses in computing their income from a business.
Generally speaking, a taxpayer can deduct an allowable loss, that being the net amount after taking into consideration any insurance or restitution proceeds in the year in which the deduction is claimed.[9] The CRA has stated this includes the cost to a taxpayer for discharging a liability to a third-party, such as a customer, that has been created as a result of the theft. For example, if a taxpayer operates a cryptocurrency business and is liable to a customer for an amount owing in relation to the theft from the Solana hack and has discharged this liability, then the taxpayer may include the amount discharged in their allowable loss for the year. Thus, the amount of the loss would generally be determined with reference to the taxpayer’s cost of the inventory for income tax purposes, less any insurance proceeds received.[10] The CRA’s policy does not permit a loss of inventory or cash to be deducted more than once, and only allows for a deduction of out of pocket losses.[11] Therefore, a taxpayer cannot deduct as a loss any unrealized profits due to the theft.[12] Accordingly, although this issue has not received clear guidance from the CRA in the cryptocurrency-context, any unrealized gains from Solana price fluctuations and staking rewards may be difficult to deduct as a loss for businesses.
While the CRA has provided some useful guidance, the CRA has also warned that its guidance, such as that laid out in IT S3-F9-C1, may not apply where the amount of the loss is disproportionate to the risks which “might reasonably be expected in the taxpayer’s business,” where the circumstances surrounding the loss are extraordinary or doubtful, or where the taxpayer has made no attempt to obtain restitution from the wrongdoer.[13]
Thus, those affected by the Solana hack should keep records of their holdings and Solana lost due to the hack and should be able to establish that such hacks occur in the crypto-industry and specifically in their business operations. This will help to prove that the loss is not disproportionate to reasonably expected risks and that the loss is not extraordinary or doubtful. Attempts to seek restitution from the wrongdoer may be difficult in this context as the hacker has not been identified. However, attempting to file claims with the authorities could support that reasonable efforts were taken by an affected taxpayer.
Compensation for stolen or destroyed capital property
Where a taxpayer receives compensation for stolen or destroyed capital property, such as cryptocurrency held as capital property, the compensation received represents proceeds of disposition.[14] Where the compensation received is from either the wrongdoer or takes the form of insurance proceeds, the taxpayer may defer all or part of any capital gain arising on the involuntary disposition of the stolen cryptocurrency.[15] In order to avail itself of the deferral, the taxpayer must purchase a replacement property. According to subsection 44(5) of the ITA, a capital property of a taxpayer will be considered a replacement property of the stolen capital property if it is reasonable to conclude the new property was acquired by the taxpayer to replace the stolen capital property,[16] or was acquired by the taxpayer or a person related to the same taxpayer for a use that is similar to the use of the stolen property.[17] In the case of cryptocurrency, the re-purchase of cryptocurrency or a similar investment instrument could potentially qualify as replacement property.
For an involuntary disposition, such as where cryptocurrency held as capital property is stolen, the replacement property must be acquired before the later of the end of the tax year following the initial year and 24 months after the end of the initial year.[18] The “initial year” is the tax year in which the compensation became receivable as proceeds of disposition for the cryptocurrency that was stolen.[19] The excess of proceeds received as compensation over the replacement cost will be deemed as the realized gain.[20] Where the taxpayer avails itself of the rollover in section 44 by satisfying the conditions and filing the relevant election, the gains arising from the disposition on the stolen cryptocurrency should be deferred until the taxpayer disposes of the replacement property (i.e., the cryptocurrency or investment instrument purchased to replace the stolen cryptocurrency).
The aforementioned is meant to describe one way in which a user who has fallen victim to the Solana hack can potentially acquire cryptocurrency as replacement property and defer the gain on the deemed disposition of the stolen property until the user disposes of the replacement cryptocurrency at a later date. The issue, of course, is whether or not the user actually receives any compensation from the thieves or insurance company. In the case of the Solana hack, it doesn’t appear compensation has been paid to any of the victims.
Where compensation is not paid on an involuntary loss of capital property, such as the Solana losses incurred through the hack, the user could ultimately claim a capital loss. The disposition of Solana is considered to have occurred when the loss of the property was discovered.[21] However, only half of the capital loss (the allowable capital loss) can be used to offset the user’s capital gains. For those who held Solana and were affected by the hack, it may be useful to review the terms and conditions of their hot wallet provider to determine whether compensation or insurance is provided in the event of a loss due to theft or fraud.
Conclusion
Blockchain hacks are loss events currently prevalent in the cryptocurrency-market. Although the authors would love to assert that such events will no longer occur in the nascent-cryptocurrency-industry, such an assertion would be inaccurate. With that being said, investors should consider the strategies discussed in this article if they are subject to such hacks and as a proactive measure in case their cryptocurrency holdings are similarly affected.
In these trying times, it is important for investors to be patient and prepared. If you need assistance with your cryptocurrency-tax concerns, please contact a member of the Miller Thomson LLP Corporate Tax team.
The authors would like to thank Raffaella Garofalo, 2022 Miller Thomson Summer Student for their contributions to this article.
[1] Eli Tan and Sam Kessler, “Solana Wallets Targeted in Latest Multimillion-Dollar Hack” (August 3, 2022), online: CoinDesk .
[2] Ibid.
[3] The CRA states that where a “virtual currency”, such as Bitcoin, is lost or stolen, Interpretation Bulletin IT-185R may be of assistance to taxpayers.[3] However, in December, 2014, Bulletin IT-185R was cancelled and replaced by Income Tax Folio, S3-F9-C1, “Lottery Winnings, Miscellaneous Receipts and Income (and Losses) from Crime” (July 3, 2020).
[4] Canada Revenue Agency, Income Tax Folio S3-F9-C1, “Lottery Winnings, Miscellaneous Receipts, and Income (and Losses) from Crime” (July 3, 2020), online: [IT S3-F9-C1].
[5] RSC, 1985 c.1 (5th Supp.) [ITA], paragraph 18(1)(a); See also David Rotfleisch, “Tax Implications of Stolen Cryptocurrency or NFT – A Toronto Tax Lawyer Analysis”, online: .
[6] IT S3-F9-C1, supra note 4 at para 1.33.
[7] Ibid at para 1.34.
[8] David Rotfleisch, “Tax Losses from Theft and Embezzlement of Bitcoin and Other Assets”, online: .
[9] IT S3-F9-C1, supra note 4 at para 1.38.
[10] Canada Revenue Agency, CRA Views, 2014-0525191E5, “Virtual currencies (Bitcoins)” (March 28, 2014).
[11] Rotfleisch, supra note 8.
[12] Ibid.
[13] IT S3-F9-C1, supra note 4 at para 1.39.
[14] ITA, supra note 5, section 54; See also IT S3-F9-C1, supra note 4 at para 1.41.
[15] ITA, supra note 5, section 44.
[16] Ibid, paragraph 44(5)(a).
[17] Ibid, paragraph 44(5)(b).
[18] Canada Revenue Agency, Income Tax Folio S3-F3-C1, “Replacement Property” (April 8, 2019), online: at para 1.6 [IT S3-F3-C1].
[19] Ibid at para 1.8.
[20] ITA, supra note 5, section 44.
[21] IT S3-F9-C1, supra note 4 at para 1.41.
