加密交易所保护基金重新计算：Bitget被黑客攻击后，你的余额真正受到哪些保障

加密交易所资金安全深度解析：以Bitget事件为例

当一家加密货币交易所发生亏损时，没有任何政府机构会介入救助。保护你在该交易所余额安全的，首先是交易所自愿做出的承诺，其次是欧洲加密法规中的责任条款。交易所可以明天就改变第一项承诺；而第二项仅适用于获得授权的交易所。2026年9月25日凌晨对Bitget发起的攻击，将这两点暴露无遗。因此，我们没有重写关于该事件的报道，而是自行检索了保护承诺并进行了数据测算。

核心结论：行业最大的内部保护基金仅能覆盖此次单一损失的1.32倍，且其持有的资产正是危机中与市场同步下跌的货币。

2026年9月24日Bitget黑客攻击：损失3.516亿美元及提现暂停

Exchange Bitget confirmed that on September 24, 2026, approximately US$351.6 million flowed out of its Hot Wallet and Warm Wallet. The company pointed out that the test time was 18:31 UTC time. According to CEO Gracy Chen, no private keys were stolen; the attacker allegedly took over the wallet backend and forged transaction data, triggering the internal approval process. Withdraws have since been suspended and the company said its cold storage assets have not been affected. Chen publicly suspected that the North Korean attacker was involved in the incident and pointed to IP tracking clues. Hot wallets are wallets with keys stored on systems connected to the Internet so that withdrawal operations can be automatically performed. Warm Wallet falls somewhere in between: it's not always online, but it's easier to access than cold storage. The exchange retains only a small portion of the assets held by customers. This share is the target of this attack. The interesting question for you as a customer is not how the attack technically occurs, but: When an exchange loses money, who will replace the money? What is the basis for this claim?

What is a cryptocurrency exchange protection fund and what it is legally not

保护基金（通常称为保险基金或安全基金）是交易所为补偿平台范围内的损失事件而预留的一批代币。这是一种自我强加的承诺，而非法定保护机制。没有人审计它，没有人规定其规模，也没有当局在其耗尽时进行赔付。这就是散户投资者经常混淆的地方。任何来自活期账户的人都知道最高10万欧元的存款保险，并心理上将其转移到交易所账户。但这种转移并不成立，原因如下文所述。一个基金有多稳健取决于三个数字：相对于现实损失事件的规模、其持有的货币以及支付条件。前两个可以计算。第三个位于交易所的细款之中。

我们的分析：保护基金中有5,500枚比特币，按9月25日价格估值

我们在2026年9月25日UTC时间约12:55检索了Bitget的基金页面（HTTP 200）。公共基金页面显示持有量为5,500 BTC，并在页面标题中携带该数字。旁边显示的价值为“基金当前价值为0美元”，这显然是一个显示错误，因为同一行中对持有量本身进行了量化。对于估值，页面参考的是当天UTC+2时间2:00的开盘价。由于页面未输出美元价值，我们自行推导。我们在UTC时间12:50获取市场数据时，比特币价格为84,462美元。* **今日基金价值：** 5,500 BTC乘以84,462美元，约为**4.645亿美元**。这与首席执行官公开引用的4.64亿美元相符，并证实了构成情况。* **本次损失所占份额：** 4.645亿美元中的3.516亿美元占基金的**75.7%**。* **账面剩余：** 约1.129亿美元，或约1,337 BTC。* **覆盖率：** 损失的**1.32倍**。如此规模的第二次事件将不再被覆盖。这些数字不是预测，也不说明公司的偿付能力，该公司自称全额承担损失，并描述客户余额是正确的。它们仅描述在单次事件后，公开声明的保护承诺还剩多少缓冲空间。

设计缺陷：比特币保护基金在需要时缩水

The second finding we calculated was heavier than the first. Funds are held in Bitcoin, so their protective value fluctuates with price. At the time of our search, Bitcoin was trading at 33.0% lower than the all-time high of $126,080 set on October 6, 2025. At the time of historical record, the same 5,500 BTC holdings were worth approximately US$693.4 million. Today it is $464.5 million. The protective effect shrank by approximately $228.9 million ** without a coin leaving the fund. This is systemic and affects all exchanges that hold their insurance funds in cryptocurrencies. Loss events are concentrated in turbulent market periods, which are precisely when such funds are at their lowest value. Our calculations also show where the limit lies: At bitcoin prices below approximately *$63,900 **, 5,500 BTC will not cover losses on September 24. This year, this price level is already within reach. Therefore, when anyone selects an exchange through their protection fund, they should never read the amount of dollars they hold, but the number of coins and compare it with actual loss events. Which providers have disclosed their safeguards and how they are supervised can be checked before opening an account.

Deposit insurance up to 100,000 euros: Why German deposit guarantee law does not cover crypto assets

法定存款保险是几乎每个人脑海中都有的基准。在德国，它位于《存款担保法》（Einlagensicherungsgesetz，简称EinSiG）中。根据第2(3)条，存款是“信贷余额，包括定期存款和储蓄存款”，产生于账户中持有的金额，并且“由CRR信用机构根据适用的法定和合同条款偿还”。根据第8(1)条，每位存款人的承保限额为10万欧元。该定义的两个特征排除了你的交易所账户。首先，必须有CRR信用机构为其背书，这意味着拥有相应许可证的银行。加密货币交易所通常不是。其次，标的物是可按面值偿还的货币余额。比特币、以太坊和Solana不是货币余额，也没有面值。在实践中这意味着：如果你在持牌合作银行运营的结算账户中持有欧元，存款保险可能适用于该欧元金额。它不适用于旁边的硬币，甚至按比例也不适用。这不是某人忘记关闭的漏洞，而是法律的构建方式。

MiCA第75条：授权加密货币交易所无法通过合同免除的责任

Since the entry into force of the European Union Crypto Asset Markets Regulation (MiCA), another thing has replaced deposit insurance that is often ignored in practice: the direct responsibility of the custodian. MiCA Section 75(7) requires crypto asset service providers to isolate customer positions from their own assets and maintain legal independence. Paragraph 8 goes further: If the incident is attributable to the provider, the provider is liable to its customers for losses caused by the loss of the cryptographic asset or its means of access. This liability is limited to the market value of the lost cryptographic asset at the time of loss. Excluded events are events that the provider proves to have occurred independently of its services, such as interruptions in the underlying blockchain itself. The decisive difference from a protection fund is that this responsibility is not a gesture of good faith. Authorized custodians cannot limit their liability to customers through their terms and conditions for losses caused by operational accidents, failures, or attacks related to the provision of services. As in the Bitget case, attacks run through the backend of the provider's own wallet are, in this interpretation, squaredly falls within the provider's scope of responsibility. BaFin's guidance note on crypto asset services under MiCAR released on January 3, 2025 describes what counts as custody: custody or control of crypto assets on behalf of customers, or means of access to them (MiCAR Article 3(1)(17)). The obligations this imposes on providers are part of the MiCA licensing responsibilities we outline.! [Responsibility Comparison Picture](https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/kryptoboerse_sicherungsfids_pruefen_2_1734fd81f7.webp)

Bitget and MiCA Authorization: pending what the application means to German customers

This responsibility is tied to one word: authorization. It applies to providers who hold a crypto asset service provider authorization in the EU and are therefore subject to the supervision of European regulators. According to its announcement of July 2, 2026, Bitget has submitted an authorization application under MiCAR to the Austrian Financial Markets Authority through its Bitget EU entity. The company stated in its announcement that it intends to provide crypto asset services in the EU once the required authorizations are granted and all applicable regulatory steps are completed, noting that the timing, scope and results of the process are influenced by authorities 'assessments. For customers with existing services around the world, the announcement stated that previous contracts and legal arrangements continue to apply. For you, this means reading calmly, and it does not imply the charges against the company: As long as authorizations are pending, your claims in loss events rely on contracts with entities outside the European regulatory framework and voluntary fund commitments. The non-exempt liability under MiCA Article 75 and access rights to European regulatory authorities will only take effect after authorization is obtained. This is the actual difference between authorized and non-authorized trading venues, and it only becomes apparent when problems arise.

Reserve certification and 1:1 support: What other exchange certifications show and don't show

为了提供背景，我们在相同的参考日期检索了另外两家面向德国投资者的提供商的安全披露。两者对损失基金模型采取了不同的方法。Kraken使用Merkle树方法发布储备金证明，并由独立的第三方审查。页面上显示的覆盖率比率在2026年6月30日的参考日期分别为：比特币102.9%，以太坊100.5%，Solana 100.6%，XRP 102.3%，Cardano 100.3%；对于列出的稳定币，超过105%。该页面上未提及客户持有资产的损失基金或保险。Bitpanda在其安全页面上引用了其自有资产与客户资产之间的法律绑定分离、所有用户持有资产的物理1:1支持、冷存储以及不使用客户资金进行投机的承诺。这里也没有保护基金或对加密资产存款保险的提及。储备金证明所提供的范围是有限的，这也属于画面的一部分。它表明持有资产在给定日期存在。它没有说它们是否受到负债的束缚，也没有替代后来被盗的赔偿。值得注意的差距是：我们调查当天，页面上显示的最新认证已有87天的历史。

保护基金或自我托管：MiCA下的购买路线和持有期

这些发现并没有得出将所有硬币撤出交易所的全面建议。以下是按目的划分的建议。你积极交易的金额属于交易场所，那里的监管问题更重要：提供商是否持有MiCA授权，以及哪个机构对其进行监督？你打算长期持有的持有资产在你自己的硬件钱包上根本不会面临交易所风险。然而，在那里，再也没有人对你的损失负责了：丢失的恢复短语永远丢失，MiCA第75条没有帮助，因为没有涉及托管方。

这对税务意味着什么，以及没有意味着什么

一个重要点，因为它经常被误解：仅仅将你自己的硬币从交易所移动到你自己的钱包并不是应税事件。你没有处置任何东西，你只是改变了它的存放地点，德国所得税法第23条下的一年持有期保持不变。税收在出售和兑换成另一种加密货币时变得相关。在实践中，这意味着你必须随身携带你的收购数据。任何人将持有资产分散在多个平台上很容易失去对每批次收购日期和收购成本的跟踪，而这些正是税务局稍后会想要的。清洁文档最容易通过跨平台整合存款和提款的税务和投资组合工具完成。对于较大的持有资产和边缘问题，这不能替代税务建议。

标记和阈值：如何衡量保护承诺是否有效

这样你就不必每次都与每个提供商重新思考这个问题，以下是我们调查中得出的检查点。**先查授权，再查基金。** 首先检查提供商是否持有MiCA授权以及哪个机构对其进行监督。只有那时，MiCA第75条规定的不可免除的责任才适用。没有授权的基金只是一个承诺，而不是索赔。**以硬币而非美元阅读基金规模。** 提供商页面上的美元数字是价格的快照。BTC或ETH的持有量是可以比较的数字。**针对现实损失进行计算。** 将基金规模与该行业实际看到的规模的事件相对照。接近1的覆盖率比率不是缓冲。**阅读支付条件。** 例如，Bitget的基金页面明确将平台范围的事件列为先决条件，并保留审查每个个别索赔的权利。显然，个别账户损失不在覆盖范围内。**检查储备金证明的年龄。** 几个月前的参考日期对今天的状况说得很少。**单独处理欧元余额。** 仅在持牌合作银行持有的货币金额才考虑存款保险。

调查方法：六个对象，一个参考日期，三个开放点

调查日期是2026年9月25日，所有检索均在UTC时间12:50至13:05之间进行。检查了六个对象，每个都返回HTTP 200：Bitget的公共基金页面、同一提供商的MiCAR公告、Kraken的储备金证明页面、Bitpanda的安全页面、德国存款担保法的第2和第8条，以及BaFin关于MiCAR下加密资产服务的指导说明。市场数据来自UTC时间12:50的单独检索。方法：原始检索披露，然后我们将硬币持有量转换为现货美元的自有转换，并与报告的损失金额进行交叉计算。有三件事我们无法验证，它们属于记录。首先，基金的硬币持有量不能在区块链上独立计数；基金页面链接了一个钱包，但在本调查中我们无法自己计数该地址。因此，5,500 BTC是提供商陈述的数字，我们报告，而不是我们计数的数量。其次，3.516亿美元的损失金额是公司声明，在我们检索时尚未得到外部最终确认。第三，MiCA法规的全文无法从我们的环境中检索；第75条的帐户基于监管文本的普遍可用版本以及BaFin指导说明中托管服务的定义。

检查保护基金： takeaway

**今天检查你的交易场所所在的监管机构。** 在你的提供商网站上查找授权、监管机构和你与之有合同的实体的注册所在地。如果你找到的是待决程序而不是已授予的许可证，你就知道第75条的责任尚未适用。排序的起点是受监管加密货币交易所的概览。**亲自运行你提供商保护基金的数字。** 采取 stated 的硬币持有量，乘以今天的价格，并将结果与3.5亿美元级别的损失相对照。如果覆盖率比率接近1，基金是一个信号而不是安全网。主要交易所在费用、监督和托管方面的比较显示在我们的最佳加密货币交易所比较中。**将交易余额与长期余额分开。** 你在未来几周内不移动的资产不属于交易所账户。将其移动到你自己的硬件钱包不会触发税收，也不会中断持有期；将恢复短语与设备分开存储，并注意每批次的收购日期和收购成本。（截至2026年9月25日。本文不构成投资建议。价格和费用结构会发生变化；购买前请与提供商核实条款。）