Because the loss occurred in 2017, you can deduct it on a 2017 amended tax return.
You did not specify the other half of your problem. It sounds like you received a 1099 – R for the 401(k) withdrawal in 2017 but did not report the income on your tax return. The IRS eventually caught up to you and sent you a tax assessment for income tax plus the early withdrawal penalty on the money.
Since the theft occurred in 2017, what you should have done was to report the 1099R as taxable income and then take a tax deduction for the theft loss. You would still have owed some tax on the withdrawal, depending on your other tax situations, but it probably would not have been as much tax as the IRS assessed in 2019. Hopefully you have since paid the assessment, otherwise it is racking up big interest and penalties. However, that makes correcting the situation a little more difficult.
I suggest that you see a CPA or enrolled agent, to assist with this tax situation, not just a storefront or seasonal tax preparer. You must file the amended 2017 return no later than April 15, 2021, or no later than two years after the date you actually filed the 2017 return if you filed it after the 4/15/18 deadline. You must report the 1099R as income and you can claim the theft loss as a deduction. That will result in your what your correct tax bill should have been for 2018. The difference between that tax bill and your assessment is the amount you have overpaid and should now be due as a refund. However, I don’t know how to specifically claim this amount as a refund in this particular situation, which is why I think you will benefit from the assistance of a CPA or enrolled agent.
