Fiscoin newsletter, 30 September 2026

Bitget hacked: what happened, and what to do if it happens to you

On 24 September, the Bitget platform was robbed of nearly 388 million dollars and froze withdrawals for all its customers. This Wednesday, USDT withdrawals resume. Four days after the hack, in Paris, the European regulator announced that it intended to keep a close eye on exactly this kind of weakness. Here are the facts, then what they change for you, including in your tax return.

Six days of frozen withdrawals

Hackers exploited a flaw in a security product supplied to Bitget by an external provider, which gave them high-level internal access. They emptied some of the platform's connected wallets, on several networks. The offline wallets were not affected, and Bitget states that its customers' balances remained intact. Investigators suspect hackers linked to North Korea.

  1. First unauthorised transfers from the connected wallets. Bitget suspends all withdrawals; deposits and trading continue.

  2. Circle, then Tether, block one of the attacker's addresses: about 318,000 dollars frozen, a tiny fraction of the loot.

  3. Bitget raises its estimate from 351.6 to 387.5 million dollars and publishes a reopening schedule, currency by currency.

  4. Bitcoin withdrawals reopen. The same day, ESMA publishes its 2027 work programme.

  5. Ether withdrawals reopen. Within 24 hours, customers withdraw a net 463 million dollars or so.

  6. Announced reopening of USDT withdrawals, on Ethereum, BNB Chain, Solana and Tron.

  7. Planned return of all other currencies, fiat withdrawals and the peer-to-peer market.

$387.5Mstolen, the largest crypto theft of the year
131%reserve ratio published on 29 September, across 19 assets
< $200Mleft in the protection fund, compared with more than $464M at the outset
$766Mlost to hacks across the whole sector in September, according to CertiK

The loss is covered by Bitget's user protection fund, which the platform says it will replenish from its own funds. For its customers, the affair should therefore end with a week of waiting, not with a loss. That is the favourable scenario. It does not happen every time.

Meanwhile, Europe shifts gear

The 2027 work programme of the European Securities and Markets Authority (ESMA) marks a turning point: after two years writing the rules of the MiCA regulation, it is moving on to supervision. Its first priorities for crypto service providers are operational resilience, the use of subcontractors and the real presence of companies in the Union. The Bitget hack, which went through an external security tool, is a perfect illustration.

ESMA also plans to make its market abuse detection system fully operational in 2027, and to feed into the review of MiCA that the European Commission is due to present by June 2027. Switzerland does not apply MiCA, which remains a European text. But many of the platforms used from Switzerland comply with it in order to serve their European customers: closer scrutiny of their security benefits you indirectly.

If it happens to you

A platform freezing withdrawals is not yet a loss. Yet what you do in the first few days determines everything else: your chances of recovering your funds, and your ability to support your tax return.

In the first few hours

  1. Only rely on official sources. The platform's website and its verified accounts. Every hack comes with fake support messages and phishing links.
  2. Freeze the picture. Screenshot of your balances with the date, full export of your transaction history, copy of the suspension announcement. If the platform shuts down its website, you will have nothing else.
  3. Note the date, the quantities and the price on the day for each currency concerned. Without these three elements, you will be able to quantify neither a loss nor a reimbursement.
  4. Ignore recovery services. Nobody can unblock your funds in exchange for payment. These offers are almost always a second scam.

When withdrawals reopen

  1. Check your balance against your screenshots and, if the platform offers it, your inclusion in its proof of reserves.
  2. Withdraw without rushing. Check the destination address and start with a small amount. Queues and outages are common in the first few days.
  3. Ask yourself what really needs to stay on a platform. What you are not trading belongs in a wallet whose keys you hold.

On 31 December

This is where tax comes in. For private wealth, capital gains are tax-exempt (art. 16 para. 3 DBG) and, in return, losses are not deductible: neither a hack nor a bankruptcy reduces your income tax. Unless the tax authorities consider you a professional trader, in which case your gains become taxable and your losses deductible. What the incident changes is your declaration of wealth, which is based on the situation at the end of the year (art. 14 and 17 StHG).

What you declare as at 31 December, depending on the outcome

Withdrawals reopenedThe Bitget case: the platform covered the loss, your balance is intact.

What you own
Your tokens, as before the incident.
Value to declare
Year-end priceAccording to the Federal Tax Administration's ICTax list or, failing that, the platform's price. Nothing special to report.
Documents to keep
Your screenshots and exports, in case the question comes up later.

Still blockedThe platform is solvent but withdrawals have not reopened by 31 December.

What you own
Still your tokens; only access is suspended.
Value to declare
Year-end priceA discount for illiquidity can be requested and justified; it depends on cantonal practice and is not automatic.
Documents to keep
Suspension announcement, date of the freeze, screenshot of the balance as at 31 December.

BankruptcyThe platform was unable to cover the theft and goes into liquidation.

What you own
Generally, a claim against the bankruptcy estate, no longer the tokens.
Value to declare
Probable recovery valueThe cantons accept that the risk of loss on an uncertain claim be taken into account, provided it is documented.
Documents to keep
Proof that you filed your claim, the liquidator's statements and distribution plan.

Two further points. If a Swiss platform goes bankrupt and your tokens were held there in a way that allows them to be individually identified, the law allows them to be segregated from the bankruptcy estate (art. 242a DEBA): you remain the owner and declare them at the year-end price. And if you are reimbursed, by a protection fund or by a liquidator, the payment restores private capital: it is not taxable income. Any interest paid on top remains an open question, to be put to your canton.

For details, in particular how to declare an uncertain claim, read our article Hacked tokens, bankrupt platform: what to tell the tax authorities?

Elsewhere this month

GermanyBerlin wants to abolish the one-year holding period

On 30 September, the German Ministry of Finance sent a preliminary draft bill to the associations concerned: for cryptocurrencies bought from 1 January 2027, gains would be taxed at 25% plus the solidarity surcharge, whatever the holding period. Holdings acquired up to 31 December 2026 would keep the current rule. The government is due to examine it on 14 October, then the Bundestag and the Länder will have to adopt it: nothing is settled. In Switzerland, gains made on private wealth remain tax-exempt, whatever the holding period.

European UnionESMA calls for the power to freeze crypto-assets

In its response to the Commission's consultation on the review of MiCA, submitted on 30 September, ESMA asks to be able to order a platform to freeze immediately any assets suspected of being linked to market abuse or money laundering, for the duration of the investigation. It also wants means to act against fraudulent websites and foreign companies that solicit Europeans without authorisation. These are proposals: the Commission is due to report by June 2027.

SecuritySeptember, the worst month of the year for hacks

The audit firm CertiK puts losses from hacks and phishing in September at around 766 million dollars, more than three times the August total. Bitget alone accounts for half of it, ahead of the Liquid network. About 270 million have since been returned or frozen: the figure measures funds stolen, not users' final losses.

Key points

  • Bitget lost 387.5 million dollars on 24 September; its customers should lose nothing, as the protection fund covers the theft.
  • ESMA is making the security and subcontracting of platforms its priority for 2027. MiCA does not apply in Switzerland, but it affects many of the platforms you use.
  • If your holdings are frozen, document everything from day one: balances, date, price.
  • A crypto loss on private wealth is never deducted from income; it only changes your wealth as at 31 December.
  • Depending on the outcome, you declare your tokens at the year-end price or a claim at its probable value.
  • Germany is preparing to end the exemption after one year; Switzerland does not tax private gains.

Sources

The basic rules, without jargon

The guide Understand explains in 33 pages how Switzerland taxes your cryptocurrencies: wealth, income, the boundary with professional activity. It will be free and will be published before the tax return season.

Get notified when it is out See the three levels