On September 24, 2026, the trading platform Bitget reported unauthorised outflows from several of its hot wallets. The loss stood at $351.6 million in the first statement and was revised upwa
On September 24, 2026, the trading platform Bitget reported unauthorised outflows from several of its hot wallets. The loss stood at $351.6 million in the first statement and was revised upward to $387.5 million in the following days, once further holdings had been added. For those affected in Germany this raises a question that barely appears in the reporting on the incident: can a loss like this be claimed on a tax return?
Under the prevailing reading today the answer is no, and it hangs on a single term in the Income Tax Act. Anyone who loses crypto-assets to a hack has not sold them. Without a sale, what the law calls a disposal is missing, and without a disposal there is no loss for tax purposes that the tax office could offset against gains. This article explains what that rule rests on, which counterarguments specialist law firms put forward, and which records to secure while the incident is fresh.
Under German income tax law, crypto-assets count as other assets. Gains and losses from selling them therefore fall under private disposal transactions pursuant to section 23 of the Income Tax Act. The provision ties the tax liability to an event it calls a disposal: an asset changes owner for consideration.
Theft does not meet that test. There is no buyer, no price and no consideration. In its overview of the tax treatment of hacks dated August 17, 2026, the specialist portal Bitcoin2Go puts it this way: wallet and exchange hacks count as theft for tax purposes and precisely do not constitute a disposal transaction, from which neither advantages nor disadvantages arise. In its account of section 23 dated October 3, 2025, the law firm Hortmann Law reaches the same conclusion and calls it doubly bitter: economic damage without tax relief.
The consequence is uncomfortably concrete. If you realised gains within the one-year period in the same year, those remain taxable, even if a multiple of that amount went missing on the exchange. The exemption threshold of 1,000 euros a year, in force since 2024 and previously 600 euros, is measured against total gains from private disposal transactions. Under the prevailing reading, a hack does not reduce that total.
Three variables determine the taxation of private crypto transactions in Germany. The holding period is one year; anyone who holds longer and then sells stays tax-free. The exemption threshold is 1,000 euros a year, and it is a genuine threshold rather than an allowance: exceed it by one euro and the entire gain becomes taxable. And loss offsetting is fenced in, because losses from private disposal transactions can only be set against gains of the same kind, not against employment income and not against investment income.
Disposal here means the transfer of an asset to another party for consideration. This single term decides the whole case. A sale for euros is a disposal, so is a swap from one coin into another, and paying for goods with crypto-assets counts too. An attacker gaining access to an exchange wallet does not.
A realised loss is a loss that has occurred through an actual market event and has become measurable as a result. As long as a price merely falls, there is a paper loss that tax law ignores. Only the sale turns it into a figure that belongs on the return. The same principle catches the hack case: the coins are gone, but there was no event that realised the loss in the sense of the law. How this looks for holdings that have become worthless is broken down in detail in our analysis of crypto total losses on a tax return.
Bitget detected the incident on September 24, 2026 at 18:31 UTC, suspended withdrawals and published a staggered resumption schedule starting with Bitcoin on September 28. According to the platform the cold wallets remained untouched; parts of the hot and warm wallet layer were affected. The analytics firm Elliptic attributed the attack to actors linked to North Korea, as Bloomberg reported on September 25; by that assessment, the 2026 annual haul attributed to this milieu passes the one-billion-dollar mark. On CryptoSlate's count, September is therefore the most damaging month of 2026.
What matters for tax in these details is less the total sum than the timing. September 24, 2026 is the date on which access to part of the holdings ended. Anyone affected needs exactly that date, the affected quantity per coin and the price on that day, because without those three details no loss can later be quantified and no compensation classified. Which protection mechanisms apply at an exchange at all is examined in our assessment of protection funds and deposit insurance at crypto exchanges.
One note on classifying the provider: Bitget holds no authorisation under the European crypto market regulation, and the European liability rule for authorised service providers therefore does not apply here. What obligations an authorisation brings and how to recognise it is set out in our overview of the MiCA licensing obligations for crypto companies.
After an exchange hack a remnant of the balance often remains; for tax purposes the event is still not a sale.
The logic behind this is not harassment by the tax administration but the flip side of a rule investors otherwise benefit from. Because only realised events count, nobody has to pay tax on a price gain while they hold the coins. The price of that system is that a loss in value without a market event likewise stays invisible.
With Bitcoin, which traded at around $84,044 when the price data was retrieved from CoinGecko on September 26, 2026 at about 12:48 UTC, this plays out neatly. Hold for more than a year and you sell tax-free. Sell within the year and you pay tax on the gain above the exemption threshold. Get robbed and you have done neither, which leaves you with no point of connection for tax purposes. We track the price development itself continuously on our Bitcoin price prediction page.
The reverse direction is interesting. Bitcoin2Go points out that inflows from fraud schemes may under certain circumstances be taxable as other income under section 22 number 3 of the Income Tax Act. Anyone who ends up on the receiving side of a questionable transaction can therefore be worse off for tax than the injured party. This asymmetry is one reason several law firms consider current practice in need of review.
The legal position is not as clear-cut as practice makes it appear. In its account of March 10, 2025, Winheller, a firm specialising in crypto law, expressly records that the tax treatment of crypto losses has not yet been conclusively settled, and puts forward good arguments for recognition. At the core of the argument is a comparison with share losses: there too a final loss of economic control occurs, and precisely that state exists with stolen or irrecoverably lost crypto-assets.
This position is a reasoned legal view, not established administrative practice. Anyone relying on it should know what they are taking on: the loss is entered on the return, the tax office will in all likelihood strike it out as matters stand, and the route then runs through an objection and possibly litigation. Without tax advice, that route makes little sense for most of those affected.
Notably, the supportive and the dismissive side agree on one point: without complete documentation the discussion is over anyway. Winheller advises documenting all transactions carefully in order to be able to prove how the loss occurred, and to evidence the timing inside or outside the one-year period as well. Anyone without the records loses regardless of which legal view ultimately prevails.
For documentation there has been a clear statement since last year. On March 6, 2025 the Federal Ministry of Finance published the circular Individual questions on the income tax treatment of certain crypto-assets, reference IV C 1 - S 2256/00042/064/043. It runs to 34 pages and replaces the earlier circular of May 10, 2022.
What is new, and decisive for the hack case, is that this circular regulates record-keeping and cooperation duties for crypto transactions expressly for the first time and raises the requirements noticeably. It demands traceable documentation of the events, including wallet allocation, timing and price evidence. For those affected by a hack that means two things: the burden of proof rests with you, and a data loss on the exchange's side does not relieve you of it. What records the tax office may demand is covered at length in our piece on crypto tax audits and admissible evidence.
The most important sentence in this text is a practical one: records you do not pull today you may no longer be able to get later. After a major incident interfaces are rebuilt, announcements disappear from news feeds, and an account being wound down eventually stops producing exports. So while access still exists, secure:
Then there is the criminal complaint. For tax purposes it is voluntary, but it is also the only document in which a third party confirms the theft, and specialist sources cite it as evidence of the final loss of control. Where it makes sense to file it and what it realistically achieves is described in our piece on where to actually file a report for stolen crypto-assets.
For ongoing documentation a tool that automatically records deposits and withdrawals and captures prices at the time of the transaction is worthwhile in any case. Which programs map this cleanly for German investors and what they cost is in our comparison of crypto tax software and portfolio trackers. Anyone who only starts collecting after an incident is reconstructing years.
Timing, quantity and transaction ID decide whether a loss can be evidenced at all.
If an exchange reimburses the damage from a protection fund, that raises a question the sources we examined leave unanswered. Neither the Finance Ministry circular of March 6, 2025 nor the specialist accounts reviewed expressly address how compensation in coins after a hack is to be classified. That is an open point, and it is named as such here rather than filled with invented certainty.
In practice two questions arise. The first concerns the acquisition date: does the original acquisition continue to count, or does a new holding period begin with the credit? The second concerns the nature of the payment: a refund in euros looks different from a credit in the same cryptocurrency. As long as there is no reliable statement from the tax administration on this, the only sensible approach is to document the event fully and to settle the question with a tax adviser before filing. For that, note the date of the credit, the quantity, the euro price at that moment, and the exact wording the provider uses to describe the payment.
Private disposal transactions are reported in Annex SO of the income tax return. That is where gains and losses from crypto sales within the one-year period go. If losses exceed a year's gains, the remainder is not lost but is separately assessed under section 10d of the Income Tax Act and carried into other years.
This mechanism is why classifying a hack loss would be worth money at all: a recognised loss would relieve not only the current year but, through the carryforward, future crypto gains as well. That is exactly why it pays to look at your own stock of old losses, which we broke down in our piece on the crypto loss carryforward.
A related case is treated differently, and the distinction is worth real money to those affected. If an exchange becomes insolvent, there is a formal procedure with claim filing, a dividend and a conclusion. At the end there is an event that can be quantified and evidenced, which brings tax recognition within reach, whereas plain theft lacks any formal point of connection. Whether your coins even form part of the insolvency estate in such a procedure depends on the form of custody; we took that apart in our piece on segregation at an insolvent crypto exchange.
In practice that means: first establish which procedure you are in. A hack with subsequent reimbursement from a protection fund is something different for tax purposes from an insolvency procedure with a dividend, and both are again different from a token for which no trading pair exists any more.
An uncomfortable consequence for custody follows from the tax system. Because a hack loss remains without tax consequences under current practice, a balance on a trading platform carries a risk that is cushioned nowhere. The usual rule of thumb of leaving only as much on the exchange as current trading requires thereby gains a second argument alongside the pure security consideration.
Anyone holding larger amounts who wants to hold them longer usually moves them into self-custody. Which devices are suitable, how they differ and which mistakes during setup become expensive is in our hardware wallet comparison. Important for tax: a transfer to your own wallet is not a sale and does not interrupt the holding period, but it has to be documented as an internal transfer so the tax office does not later read it as a disposal.
Two signals are worth watching. If an affected provider's withdrawal schedule holds and the announced stages actually begin, that points to an orderly process. If it is postponed, capped or suspended without explanation, the case shifts towards a default, and then the records from the section above become the most valuable thing you still hold in the matter.
(As of September 26, 2026. This article is not investment advice and not tax advice. Prices, fee structures and administrative views change; check the terms with the provider before you buy and settle individual tax questions with a tax adviser.)
