stolen cards

PSA’s stolen cards list is a 93-page PDF that PSA published on October 23, 2026. It names all 6,451 items stolen from a FedEx truck on October 13, after the truck picked up customer orders at PSA’s Santa Ana, California, facility. Before you buy any PSA slab, search its cert number in that PDF, then run it through PSA Cert Verification. PSA says it has deactivated the cert of every stolen graded item. If the number is on the list, or won’t verify, don’t buy. A clean result lowers the risk, but it doesn’t prove the slab is safe.

Card Core counted every line of the PDF. The list is mostly not vintage grails. Pokémon makes up 2,978 of the 6,451 entries (46%) and One Piece another 898, and 2,997 entries carry a 2025 or 2026 set year. So the slabs most exposed are everyday modern TCG slabs: the kind that sell fast, in bulk, from sellers you don’t know.

What PSA published, and what it left out

PSA’s October 23 theft update says both the Santa Ana Police Department and the FBI are investigating. PSA says it shared the full list with “marketplace sellers, auction houses, and digital commerce platforms,” and that they are monitoring for the items. The only official dollar figure so far comes from police: about $963,000 for two stolen pallets, per the Los Angeles Times and AP. The LA Times reported that about 50 packages from a third pallet were also taken, and their value was still being calculated. Private estimates of the total vary a lot. We aren’t repeating them, because the list gives no grades.

The PDF has two columns: cert number and card description. It lists no grades and no values. That matters for anyone searching by card name. Matching a description proves nothing, because thousands of identical cards are legitimately for sale. Only the cert number ties a slab to the theft.

What’s actually on the list

We downloaded PSA’s PDF on October 28, 2026, and counted entries by keyword in PSA’s own descriptions. Every one of the 6,451 cert numbers appears exactly once. Our totals match the tally Cardboard Police published on October 24.

• By game: 2,978 Pokémon entries, 898 One Piece, 58 Yu-Gi-Oh!, 56 Dragon Ball, 27 Lorcana and 8 Magic. Pokémon and One Piece together are about 60% of the list.
• Language: 1,831 descriptions include the word “Japanese.”
• Age: 2,997 entries have a 2025 or 2026 set year, 1,672 are from 2020 to 2024, 1,566 are from 1980 to 2019, and only 202 predate 1980.
• Sports: 185 entries name Michael Jordan and 202 name Victor Wembanyama.
• Vouchers: 14 entries are grading vouchers with no card details.

Here’s what that means for buyers. Before the list came out, most attention went to the theft’s famous vintage cards. By count, though, the typical stolen item is a recent Pokémon or One Piece slab, often Japanese. That is the same modern graded market where, as our Pokémon PSA 10 vs raw report showed, the slab carries much of the card’s value. If you shop that market, check every cert, not just the expensive ones.

A five-step check before you buy a PSA slab

1. Get the cert number from the slab itself. On a PSA slab it sits at the lower right of the label. Ask for a clear, current photo of the label if the listing doesn’t show it. A seller who won’t show the cert is your answer.
2. Search PSA’s PDF. Open the list and use your browser’s find (Ctrl+F, or Command+F on a Mac) with the full number. Third-party search tools exist, but PSA’s file is the source.
3. Run it through PSA Cert Verification. Enter the number on PSA’s cert page. If it doesn’t come up, stop. PSA’s own page says verification “does not eliminate risk,” which is why the next step matters.
4. Match the record to the slab. A valid cert number isn’t proof on its own. PSA’s cert page warns that criminals sometimes make fake PSA labels using real cert numbers taken from public sources. The stolen list just made 6,451 more real numbers public. Check that the card, year, set and grade on PSA’s record match the slab in your hand.
5. Buy where someone else checks too. PSA’s 2025 Fraud Report says eligible items of $250 or more sold through eBay’s Authenticity Guarantee are inspected by PSA before delivery. Keep the receipt and the listing screenshots either way.

The harder problem: cracked slabs and raw cards

Cert checks only work while the card is still in its slab. If a thief cracks the slab, nothing on a raw card links it to the theft. PSA says the list includes serial numbers for serialized cards. In the copy we downloaded, though, most entries for numbered parallels show the set, card number and parallel name, not which copy it is. Only about 20 descriptions carry a number like 1/1. For example, the three 2025 Topps Finest Wembanyama #98 refractor entries don’t say which copy was taken.

So when you buy a raw copy of any card that appears on the list, slow down. Resell Calendar suggests checking an eBay listing’s revision history. A revision dated before October 13 shows the listing existed before the theft. If there’s no history, ask for dated photos or purchase records. A big discount plus a vague backstory is a reason to walk away. The same goes for a graded card that was “just cracked” with no explanation.

Check the cert, not the seller’s reputation

Don’t jump to conclusions either way. On October 27, collectors found slabs with deactivated certs listed by an eBay seller with more than 3,000 sales. Social media assumed the seller had a role in the heist. Resell Calendar reported that the seller was actually one of the victims. Their listings were created before the theft and set to zero quantity on October 16. That cuts both ways. A trusted seller can still have a dead cert in their store, and a dead cert doesn’t make someone a thief. The cert lookup is the evidence. If your own cards were on the truck and you listed them early, take those listings down.

Why a stolen slab has no real exit

Card Core usually judges a card by how easily you can sell it, and a slab on this list can’t be sold through any platform that checks certs. PSA’s update adds a second risk. Owners who accept compensation can still choose to get their card back if it’s recovered. A buyer who ends up holding a recovered card could lose both the card and the money they paid. A “discount” on a slab whose cert won’t verify isn’t a discount. Comp watchers should be careful too: a sale involving a cert on this list isn’t a clean comp, just as unpaid auction results weren’t in our Fanatics Collect comp checklist.

For people sending cards in, PSA says it compensates orders shipped on its return label at fair market value, up to each item’s declared Maximum Insured Value. It also says it has refunded grading fees on the affected orders. If you’re weighing a submission now, the costs and wait times in our PSA Standard tier and backlog math still apply. So does the declared value you write on the form.

If you’re a victim or you spot a card

PSA’s update gives the FBI’s instructions. Call the FBI Los Angeles field office at +1 310-477-6565, press 1 during business hours (8 a.m. to 5 p.m. Pacific), and ask for the duty agent handling the PSA theft. The same line takes tips. Victims should also contact PSA support, or their dealer if they submitted through one. The carrier was FedEx. As of October 27, no arrests or recoveries had been announced.

For more on how grading and sales venues shape what a card is worth, browse Card Core Market News and our Collector Guides.