First, it is always a crime no matter who it is to steal your identity and to take funds that do not immediately belong to that person. So, in your situation and depending on your state's statutes, it could be considered a crime (state) if your wife stole your password and that act constitutes identity theft in your state and it could be considered identity theft and some sort of interstate crime if the funds were technically transferred while held in one state and deposited in an account or given to another person in another state. Further, if your wife is only a beneficiary on the 401k, and you were not splitting the assets yet as part of a divorce, then it is also a crime, larceny or worse. Immediately contact the police and a lawyer. Further, shame on the company who won't do anything about it because ten to one that company's processes and lack of proper safekeeping of your funds may violate laws under which it is licensed or registered to conduct such business, GLBA (Gramm-Leach-Bliley Act is one that comes to mind).  You need to find out which entity regulates that entity that holds the 401k - easy to find out but also consider filing a complaint with your state attorney general and the federal reserve.