交易所遭黑客攻击导致硬币被盗：德国税务局认可的损失认定标准

2026年Bitget黑客事件：被盗加密货币的税务处理与应对指南

2026年9月24日，交易平台Bitget报告称其多个热钱包出现未经授权的资金流出。初步声明中的损失金额为3.516亿美元，随后几天在计入更多持仓后，该数字被上调至3.875亿美元。对于受影响的德国用户而言，新闻报道中极少提及一个关键问题：此类损失是否可以在所得税申报中进行抵扣？

现行法规下的否定答案及其法律依据

根据目前的普遍解读，答案是否定的。这一结论取决于《所得税法》（Einkommensteuergesetz）中的一个单一术语。任何因黑客攻击而丢失加密资产的人，并未“出售”这些资产。在法律意义上，没有发生“处置”（Veräußerung），因此不存在税务局可以抵消收益的税务亏损。

本文将解释该规则的基础、专业律师事务所提出的反驳论点，以及在事件发生后应保存哪些记录。

交易所黑客攻击与税务：为何盗窃不构成处置交易

在德国所得税法下，加密资产被视为其他资产。因此，出售它们产生的收益和损失属于《所得税法》第23条规定的私人处置交易。该条款将纳税义务绑定在一个被称为“处置”的事件上：即资产在有对价的情况下转移所有权。

Theft does not meet this test criterion. There are no buyers, no prices, and no consideration. Professional portal Bitcoin2Go pointed out in an overview on the tax treatment of hacking incidents released on August 17, 2026:"Wallet and exchange hacking are considered theft for tax purposes, accurately do not constitute disposal transactions, and generate neither gains nor losses." Law firm Hortmann Law reached the same conclusion in its interpretation of Article 23 on October 3, 2025, calling it a "double bitterness": economic losses without tax relief.

The impact of tax exemptions

The consequences are self-evident. If you realize gains within the same year, even if the exchange loses multiple times of the gains, those gains will still be taxable. The annual tax exemption of € 1,000, effective from 2024 (previously € 600), is measured based on the total proceeds of private disposal transactions. According to current interpretation, hacking will not reduce this total.

Detailed explanation of Article 23 of the Income Tax Law: Meaning of holding period, tax exemption limit and disposal

German private crypto transaction tax is determined by three variables:

• Holding period: One year. Selling after holding for more than one year is tax-free.
• Tax exemption: 1,000 euros per year. This is a real threshold rather than a deduction: all gains above 1 euro are subject to tax.
• Loss deduction: is restricted. Losses from private disposal transactions can only be offset against similar gains, and cannot be offset against labor income or investment income.

"Disposal" here refers to the transfer of assets for consideration to another party. This term determines the entire case. Selling in euros is a disposal, so is exchanging one coin for another, and using crypto assets to pay for goods. However, an attacker gaining access to an exchange wallet does not constitute a disposal.

Realizing as a core condition

Realized losses are losses that occur through actual market events and are therefore measurable. As long as prices fall, it is only an accounting paper loss that is not recognized by the tax law. Only a sale can convert it into a number on the return form. The same principle applies to hacking cases: the coin disappears, but no legal loss occurs.

Bitget Event on September 24, 2026: What details are crucial to tax

Bitget detected the event at 18:31 UTC time on September 24, 2026, suspended the withdrawal, and released a plan to gradually resume the withdrawal of Bitcoin starting from September 28. According to the platform, cold wallet was not affected; some hot money packages and warm wallet layers were affected. Analytics firm Elliptic blamed the attack on North Korea-related actors. According to a Bloomberg report on September 25, 2026, it was estimated that the annual amount of robberies attributed to the environment in 2026 has exceeded one billion US dollars. Therefore, September is the most devastating month in 2026.

对这些细节而言，对税务重要的是时间点而非总金额。2026年9月24日是部分持仓访问权限终止的日期。任何受影响者都需要确切知道该日期、每种硬币的受影响数量以及当天的价格，因为缺少这三个细节，无法量化亏损或分类赔偿。

需要注意的是，Bitget未获得欧洲加密市场法规（MiCA）下的授权，因此不适用于授权服务提供商的欧洲责任规则。

为何税务局需要“出售”，而黑客攻击未能提供它

背后的逻辑并非税务局的骚扰，而是投资者通常受益的规则的另一面。因为只有实现的事件才计入税收，所以在持有硬币期间没有人需要为价格上涨缴税。这个系统的代价是，没有市场事件的贬值同样保持不可见。

以比特币为例，在2026年9月26日UTC时间约12:48从CoinGecko获取价格数据时，比特币交易价格约为84,044美元。持有超过一年则免税出售；在一年内出售则需缴纳超过免税额度的收益税。被抢劫则两者皆非，导致缺乏税务联系的连接点。

另一侧的特殊情况

反向情况很有趣。Bitcoin2Go指出，欺诈计划的流入在某些情况下可能根据《所得税法》第22条第3款作为其他收入征税。因此，处于可疑交易接收方的人可能在税务上比受害方处境更糟。这种不对称性是几家律师事务所认为当前实践需要审查的原因之一。

律师事务所的反立场：经济控制权的最终丧失

法律立场不像实践中看起来那样清晰。专注于加密法律的事务所Winheller在2025年3月10日的解释中明确表示，加密亏损的税务处理尚未最终确定，并提出了认可的有力论据。其核心论点是与股票亏损的比较：那里也存在经济控制权的最终丧失，而在被盗或无法收回的加密资产中正是存在这种状态。

这是一种合理的法律观点，而非既定的行政实践。依赖此观点的人应清楚其所承担的风险：亏损将填入申报表，税务局很可能会按现状将其剔除，随后的途径将是异议甚至诉讼。大多数受影响者在没有税务建议的情况下，走这条路意义不大。

双方的共同点

It is worth noting that both supporters and opponents agree on one point: without complete documentation, the discussion ends anyway. Winheller recommends carefully recording all transactions to prove how the loss occurred and whether it occurred within a year or outside. No matter which legal view ultimately prevails, those without records will lose.

Circular of the Ministry of Finance on March 6, 2025 and strengthened cooperation obligations

Since last year, there have been clear statements in terms of documents. On March 6, 2025, the German Federal Ministry of Finance issued a circular "Individual Issues on the Treatment of Income Tax on Certain Cryptographic Assets"(reference number IVC1-S2256/00042/064/043). The document is 34 pages long and replaces an earlier circular dated May 10, 2022.

The new content and decisive content for hacking cases is that for the first time, the circular clearly stipulates the recording and collaboration obligations of crypto transactions, and significantly increases the requirements. It requires traceability documentation of the event, including wallet allocation, time and price evidence. For someone hacked, this means two things: the burden of proof is on you, and the loss of data on the exchange side does not absolve you of liability.

Evidence should be ensured immediately after an exchange hack occurs

The most important sentence in this article is practical: The records you don't retrieve today may never be retrieved tomorrow. After a major event, the interface will be rebuilt, announcements in the news source will disappear, and the account will be closed and exports will eventually stop being generated. So while the access still exists, please save:

• 账户的完整交易导出文件（不是截图），涵盖自账户开立以来的所有存款、提币和交易。
• 事件发生前每种硬币的余额，包含日期和时间。
• 提供商关于事件的官方声明，作为可见日期的截图，并另存为网页。
• 提供商发送给你的每条消息，即带有案例编号的电子邮件、应用内通知和支持工单。
• 参考日期的欧元价格证据，来自必要时可再次查询的来源。
• 你的钱包地址和交易ID，只要流出是公开可追踪的。

此外还有刑事报案。在税务目的上是自愿的，但它是第三方确认盗窃的唯一文件，专家来源引用其作为控制权最终丧失的证据。

代币补偿：获取成本和持有期的开放问题

如果交易所从保护基金中赔偿损失，这就引发了我们检查的来源未回答的问题。2025年3月6日的财政部通函或审查的专业账户均未明确说明黑客后代币赔偿如何分类。这是一个开放点，在此命名为开放点，而非用虚构的确定性填充。

在实践中会出现两个问题。第一个涉及获取日期：原始获取是否继续计算，还是新的持有期从贷记开始？第二个涉及付款性质：欧元退款与相同加密货币的贷记看起来不同。在税务局对此没有可靠声明之前，唯一明智的做法是完全记录事件，并在提交之前在税务师处解决该问题。为此，注意贷记日期、数量、当时的欧元价格以及提供商描述付款的确切措辞。

附件SO和亏损结转：已确认亏损的去向

私人处置交易在所得税申报表的附件SO中报告。这是年内加密销售收益和亏损所在的地方。如果亏损超过一年的收益，剩余部分不会丢失，而是根据《所得税法》第10d条单独评估并结转至其他年份。

这就是分类黑客损失值得金钱的原因：已确认的亏损不仅缓解当年，还通过结转缓解未来的加密收益。

交易所破产而非黑客：何时短缺成为亏损

相关案件的处理方式不同，这种区分对受影响者来说价值不菲。如果交易所破产，有正式程序包括债权申报、股息和结案。最后有一个可量化和证明的事件，使税务认可触手可及，而单纯的盗窃缺乏任何正式的连接点。在你的硬币是否构成此类程序中的破产财产，取决于保管形式。

在实践中，首先确定你处于哪种程序。随后从保护基金中获得赔偿的黑客事件，在税务上与获得股息的破产程序不同，两者又不同于不再存在交易对的代币。

限制交易所持仓：税务规则对你保管的意义

由于现行实践下黑客损失没有税务后果，交易平台上的一笔余额承担着无处缓冲的风险。通常的建议是将仅够当前交易使用的余额留在交易所，由此获得了除了纯粹安全考虑之外的第二个理由。

持有大量金额并希望长期持有的人通常将其移至自我托管。重要提示：转移到自己的钱包不是出售，也不会中断持有期，但必须记录为内部转账，以免税务局后来将其读作处置。

解读情况的标记

有两个信号值得关注。如果受影响提供商的提币计划保持不变并实际开始宣布的阶段，这表明是一个有序的过程。如果被推迟、限制或无理由暂停，案件转向违约，那么上述部分的记录成为你在此事中仍持有的最有价值的东西。

被盗硬币与税务：要点总结

不要期望黑客损失的税务减免，但仍需进行算术计算。

• 检查你在同年内是否在一年内实现了收益，因为这些收益仍需纳税。
• Keep records today that you will no longer have tomorrow. Trade export, pre-event balance, provider statement, price evidence from reference date, and transaction ID.
• Check the authorization status of the trading venue before parking the next balance there.

(As of September 26, 2026. This document does not constitute investment advice or tax advice. Prices, fee structures and administrative views are subject to change; please verify terms with the provider before purchasing and consult a tax specialist on individual tax issues.)