OGH: Bitcoin Loss Not Classified as ‘Theft’

May 14, 2026 Benn-Ibler Rechtsanwälte

In this insurance law case at hand, the Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) examined whether the unauthorised acquisition of cryptocurrencies through malware qualifies as theft according to the relevant insurance policy terms and conditions.

After buying bitcoins, the claimant managed them through a physical hardware wallet. However, all funds were still accessible without the device if the correct recovery phrase was provided.

Malware attack after compromised recovery phrase

He later submitted a claim for compensation regarding the transferred Bitcoins through his household insurance policy, asserting that the perpetrators accessed the private key stored in the hardware wallet via malware, subsequently transferring the Bitcoins. He contended that this constituted burglary as defined by the insurance terms and conditions.

The claim was rejected by the lower courts, and the OGH has recently confirmed that ruling.

Definition of ‘simple theft’

Section 20.4.1.4 of the Austrian ABHP 2011 (General Conditions for Household Insurance, Allgemeine Bedingungen für die Haushaltsversicherung) defines ‘simple theft’ as the theft of insured items without meeting the criteria for burglary or robbery. In such cases, the removal is considered to occur in violation of the policyholder’s actual physical control over the property.

No tangible property was stolen, therefore no ‘simple theft’

In the present matter, no tangible property was misappropriated from the claimant. Additionally, the malware was not employed to facilitate entry into the claimant’s residence. Instead, it served to induce the claimant to reveal access credentials for his crypto assets and provide the recovery phrase. Subsequently, the perpetrator utilized this information to obtain access to bitcoins stored on the blockchain.

Criminal law literature and case law indicate that transferring crypto assets by using passwords acquired through deception does not count as theft. Instead, it is considered fraudulent misuse of data processing under Section 148a of the Austrian Criminal Code (Strafgesetzbuch).

Therefore, the lack of removal necessary to breach actual physical control demonstrates that ‘simple theft,’ as defined under Article 20.4.1.4 of the ABHP 2011, was not applicable in this case.

OGH 7 Ob 225/25a (25 March 2026)