We don't know of any confirmed cases of warheads being stolen. There are no public cases of anyone trying to sell actual nuclear material or nuclear weapons (though there are several cases of people trying to scam people into buying "nuclear material" that was fake). The problem is that the post-Soviet system was chaotic and the record-keeping poor, so we don't have any way of decisively knowing if any weapons or materials went missing.

As for whether a warhead could be detonated, it would require knowing a lot about the specific warhead. The Soviets did supposedly have some sort of Permissive Action Link (PAL) technology (locks, of varying degrees of sophistication, that prevent unauthorized detonation of a nuclear warheads) on some of their warheads. But the details are not available. PALs in the US context ranged from things that were basically the equivalent of bicycle locks (early PALs used on nuclear artillery), to things that are very sophisticated and built into the weapons themselves (modern PALs, which can make the warhead unusable if tampered with or if the wrong unlock code is entered). We don't know what the Soviet PALs are like, and we don't know how universal these were applied to Soviet warheads, especially Soviet tactical nuclear weapons, which were both plentiful and small. We also don't know whether the limited-lifetime components in a warhead stolen in the 1990s would mean the weapon was unusable today. There are some designs that would be basically functional for decades, or require very little updating to be usable. There are others that require refreshing with exotic materials every so often to stay viable. We have no information about where the more vulnerable Soviet warheads sit on this scale.

The other scenario is that a weapon (even a broken or locked one) could be disassembled and its fissile material removed and re-used. Whether this is a major threat depends on who you imagine is doing the disassembling and how much material is in the weapon, the latter being classified.

So you can see there are many unknowns here. This is why quantifying the precise threat of "loose nukes" is very difficult. Do we interpret the apparent lack of visible evidence of a post-Soviet nuclear black market as a sign that there isn't one, or that we just haven't seen it yet? As time goes on, my sense is that people in the security space are less worried about post-Soviet nukes and that they are more worried about something being sold or stolen out of Pakistan or North Korea (or, in the future, Iran).