Every time the Celsius bankruptcy estate makes a distribution, a wave of emails follows, and a good share of them are not from Celsius. They arrive from addresses that look official, reference real court dates, and ask you to do something small and urgent: confirm a wallet, verify identity, claim funds before a deadline. The people behind them know that creditors have been waiting years and will move fast when money appears to be moving. Here is how to tell the real messages from the fakes, and what to do if you have already clicked.
How the real process works
Celsius distributions are administered by Stretto, the court-appointed claims agent. Official notices come from Stretto and Celsius email domains and are posted at cases.stretto.com/celsius and the Celsius distribution support site, not through phone calls, text messages, or social media. Crypto distributions arrive through Coinbase or PayPal and Venmo, the distribution partners creditors set up during the claims process; creditors who cannot receive crypto are paid in dollars through Hyperwallet. The fourth distribution, announced January 2026, followed the same channels. Nothing in that process requires your seed phrase, your private keys, or a fresh wallet connection to a site you have never used.
Prefer to watch? James covers the same warning signs in about two minutes.
The tells
The sender domain is almost right
Look at the address itself, not the display name. Legitimate notices come from Stretto and Celsius domains listed on Stretto’s approved-domains page; phishing comes from lookalikes with an extra word, a swapped letter, or a different ending. When in doubt, open the official portal directly from a bookmark rather than from the email.
It asks for a seed phrase, private key, or wallet connection
No distribution ever requires this. A request to “verify” a wallet by entering the recovery phrase is the whole scam; whoever holds the phrase holds the coins. Sites that ask you to connect a wallet and sign a transaction to “unlock” a distribution are draining wallets, not funding them.
It manufactures a deadline
Real court deadlines are published in advance in the docket and repeated in official notices. A message that gives you 24 or 48 hours, or says funds will be forfeited if you do not act today, is using pressure to stop you from checking.
It arrives somewhere Celsius would not use
Text messages, Telegram, Discord DMs, and X replies are not how a bankruptcy estate communicates with creditors. Support accounts that appear in your replies offering to help with a claim are impersonators.
The link goes somewhere else
Hover before you click. Shortened links, links whose visible text and destination differ, and login pages that do not match the official portal’s address are all reasons to close the message.
What to do with a suspicious message
Do not reply, do not click, and do not download attachments. Go directly to the Stretto case site and the distribution support site linked above and check for the same notice there. If it exists, act through the official channel. If it does not, the email was not real. Stretto maintains a page of approved email domains and known phishing attempts; compare the sender against it, then delete the message.
If you already clicked
If you entered a seed phrase or signed a wallet transaction, assume the wallet is compromised. Move any remaining assets to a new wallet with a freshly generated phrase, revoke token approvals granted to the malicious contract, and change the password and enable two-factor authentication on any exchange account that shares an email address with the compromised wallet. Then document everything: the email, the site, the transaction hashes, the dates. That record matters for two reasons.
First, stolen crypto may be deductible. Whether a theft loss can be claimed depends on the facts and on how the loss is characterized, and the rules changed again with recent IRS guidance. The documentation is what makes the claim possible.
Second, a compromised wallet breaks your cost basis history. Coins that leave without a sale still have to be accounted for, and the reconstruction is easier while the transaction hashes are fresh.
The distribution itself is a tax event
Separate from the scam, a Celsius distribution has to be reported, and there is more than one way it can land. Depending on how the frozen assets were handled on your earlier returns, the same distribution can be taxable income, a gain or loss, or a non-taxable transfer of your own coins. The right answer depends on your records and on what was filed for the years the assets were frozen, so it is worth a conversation with someone on our team before you assume.
Schedule a confidential consultation and bring your Celsius statements and prior returns; we will tell you which outcome applies and what it costs to get it right. For background on how the bankruptcy affected creditors’ taxes, see Celsius payouts: will you owe taxes or get relief?.
nnIf you are sorting out a Celsius claim, a compromised wallet, or both, cost basis reconstruction is where we start. Bring the emails too; they are part of the record.
This article is general information about tax and accounting topics and is not advice for your situation. Rules change; check the published and updated dates above and confirm current law before acting. Reading this article or contacting Gordon Tax does not create a client relationship.