What’s changing right now: the Bitcoin radar (as of September 2026)

Bitcoin itself changes slowly; the rules around it change faster. Here is what is moving in supervision (EU-wide), tax (Germany), technology and security – and whether you need to do anything. As of 28 September 2026.

Key dates at a glance

1. 5 May 2026

   Germany’s Greens introduce a bill on crypto taxation

   The holding period would be abolished; this has not been passed.^[4]

2. 1 July 2026

   MiCA transitional period ends EU-wide

   Providers without authorisation must wind down their EU business in an orderly way.^[1]

3. 30 July 2026

   Security warning for COLDCARD devices

   A firmware bug weakened seed generation; funds were stolen.^[9]

4. 8 August 2026

   BIP-110 split

   A small minority split off from the network. Since early September, its chain has run as a separate currency, with almost no miners or trading.^[7],[8]

5. Early September 2026

   German Finance Ministry’s draft bill becomes public

   Flat-rate withholding tax instead of the holding period for purchases from 2027 – being coordinated within the government, not adopted.^[5],[6]

6. 31 October 2026

   Deadline for Mt. Gox repayments

   Deadline in Japan time, already extended three times.^[10]

7. 1 January 2027

   Two cut-off dates

   Deadline for existing customers’ tax self-certification in Germany^[3] and – only in the ministry’s draft – the date from which purchases would fall under the new taxation.^[5]

8. 10 July 2027

   EU Anti-Money Laundering Regulation (AMLR) applies

   No anonymous crypto accounts at providers, and a cash limit of €10,000.^[2]

9. 31 July 2027

   First reports under DAC8

   Providers report the data for 2026 to Germany’s Federal Central Tax Office.^[3]

Supervision: what now applies to providers

MiCA: no authorisation, no new business

The EU regulation MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× sets out who may provide crypto services in the EU, such as holding, exchanging or transferring bitcoin. The transitional period for providers without MiCA authorisation ended EU-wide on 1 July 2026. The European securities regulator ESMAGlossaryESMA (European Securities and Markets Authority)The EU authority for securities and financial markets, based in Paris. What matters to you is its MiCA register: it lists all crypto-asset service providers authorised in the EU.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× requires them to:^[1]

• take on no new customers from the EU and stop advertising,
• only allow existing positions to be sold, transferred or closed,
• hold customer assets only for as long as an orderly exit requires.

Providers based outside the EU may likewise neither serve nor solicit customers in the EU, apart from narrow exceptions. Anyone who stays with an unauthorised provider has no MiCA protection, including for their assets.^[1]

What it means for you: Check whether your provider is on ESMA’s register. If it isn’t, ESMA advises acting promptly, for example by transferring your bitcoin to an authorised provider or to your own wallet.^[1] Authorisation is not a seal of quality, though: it says nothing about fees or whether you can withdraw to your own wallet. MiCA & regulation simply explained shows how to read the register; Choosing the right provider covers what else to look for.

Anti-money-laundering rules from July 2027

From 10 July 2027, the EU Anti-Money Laundering Regulation AMLRGlossaryAMLR (EU Anti-Money Laundering Regulation)An EU regulation against money laundering that applies from 10 July 2027. It bans anonymous accounts at banks and crypto service providers and caps cash payments in trade at €10,000. Self-custody of bitcoin remains permitted.In the glossary →× applies directly in all member states. Two rules matter for Bitcoin:^[2]

• No anonymous accounts: banks, financial institutions and crypto service providers may not keep anonymous crypto-asset accounts, nor accounts that obscure transactions.
• Cash limit: traders and service providers may neither accept nor make cash payments above €10,000.

What it means for you: With authorised providers, where you register with ID anyway, little changes. Self-custody remains permitted: according to the recitals, the ban does not apply to providers of wallet hardware and software that have no access to the wallets.^[2] More in Privacy with Bitcoin.

Tax in Germany: more transparency, an open reform

This section covers Germany. If you pay tax elsewhere, Bitcoin tax around Europe shows where to look.

DAC8: providers report your transactions

Germany implements the EU directive DAC8GlossaryDAC8 (EU reporting rules for crypto-assets)EU directive that has required crypto providers to report customer data and transactions to the tax authorities since 1 January 2026. In Germany, the KStTG implements it; the first report, for 2026, is due by 31 July 2027.On the learning path: Stage 6 · Step 3 – Bitcoin & tax →In the glossary →× through the Crypto-Asset Tax Transparency Act (Kryptowerte-Steuertransparenz-Gesetz, KStTG) of 22 December 2025, for the first time for the 2026 calendar year:^[3]

• Self-certification: your provider asks for your tax ID, among other things.
• Annual report: by 31 July, it reports the previous year’s data to the Federal Central Tax Office (Bundeszentralamt für Steuern), for the first time by 31 July 2027.
• Content: name, address, tax ID and, for each crypto-asset, for example purchases and sales for money, exchangesTermExchange (crypto exchange)A trading platform where buyers and sellers trade bitcoin with each other via an order book.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →AdLicensed providers with a paid linkProviders from our comparisonKrakenExchange · MiCA (Central Bank of Ireland)Visit Kraken* (paid link, opens in a new window)BitvavoExchange · MiCA (AFM, Netherlands)Visit Bitvavo* (paid link, opens in a new window)CoinbaseExchange · MiCA (CSSF, Luxembourg)Visit Coinbase* (paid link, opens in a new window)All 7 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.× and transfers. Transfers to addresses not attributed to any known provider are reported too, aggregated with market value and quantity – typically withdrawals to your own wallet.^[3]

Dive deeperAlready a customer before 2026?

Then your provider must obtain your details by 1 January 2027. If you still don’t provide them after a reminder and a warning, it must block you from reportable transactions no earlier than 60 and no later than 90 days after the first request, until you supply them.^[3]

What it means for you: If your provider asks for your tax ID, that’s normal. Only enter it in the official app or on the website you open yourself – never via a link in an email or text message. DAC8 doesn’t change the tax rules, only the transparency.^[4] Details: DAC8 & reporting obligations.

Holding period: two proposals, nothing decided

Under current German law, gains on privately held bitcoin are tax-free if more than a year passes between buying and selling.^[4] Two proposals would abolish this holding periodGlossaryHolding period (speculation period)In Germany, the gain from selling privately held bitcoin is tax-free if more than one year passes between purchase and sale (§ 23 EStG, as of September 2026). Each purchase has its own holding period.On the learning path: Stage 6 · Step 3 – Bitcoin & tax →In the glossary →×: the Greens want to scrap it for purchases from 2026 (personal income tax rate), the Finance Ministry’s draft bill for purchases from 2027 (26.375% flat-rate withholding tax including solidarity surcharge).^[4],[5] The reform tracker compares them in detail.

As of late September 2026, nothing has been decided. The CDU/CSU has voiced reservations, and whether existing holdings would really stay protected is considered open.^[5],[6] Supporters of a reform point to equal treatment with gains on shares, which are always taxable, and to the fact that such a tax exemption is the exception in the EU.^[4] Critics counter that long-term savers have relied on the existing rules and that two parallel systems would complicate tax returns.

What it means for you:

• Current law applies until a law has been passed and promulgated.
• Buying ‘before the cut-off date’ is not a safe plan. The proposals name different cut-off dates, and any of them can still change during the legislative process. Under the Greens’ bill, even purchases since 1 January 2026 would be affected.^[4]
• The price matters more than the tax. An example in euros, because the German tax office calculates in euros: you buy €5,000 of bitcoin after the planned cut-off date and sell two years later for €8,000. Under current law, the €3,000 gain would be tax-free. Under the ministry’s draft, €1,000 would stay tax-free through the saver’s allowance, provided you don’t already use it for interest or dividends; 26.375% would be due on €2,000, around €528. If the price falls by 20% shortly after you buy, your stake is worth €1,000 less – almost twice as much.
• Keeping records helps either way. If acquisition data is missing, the ministry’s draft would treat a flat half of the sale proceeds as the tax base.^[5] Some tax advisers recommend keeping old and new holdings in separate wallets.^[6]

Technology and security

BIP-110: a minority splits off

The BIP-110 proposal aimed to stop images, text and other non-financial data from ending up in Bitcoin transactions for one year. Supporters wanted to reduce load and costs on the network; opponents say whoever pays for space in a block may use it as they wish.^[7]

It did not prevail. In the two weeks before the deadline, only 2.53% of blocks signalled support. On 8 August 2026, the supporters’ nodes split off at block 961,632; over the following eight hours or so, their chain found 2 blocks and the main chain 48.^[7] Since early September 2026, the split-off chain has continued as a separate currency with a different mining algorithm (BLAKE2b). Miners and major exchanges have largely ignored it.^[8]

What it means for you: Your bitcoin are not affected; the main chain carries on as normal and is currently at block 970,043. Because both chains share the same history, they initially accepted the same transactions. Anyone selling coins from the split therefore risked spending real bitcoin as well.^[7] Never enter your seed phrase into software that promises you such coins. The lesson: Bitcoin’s rules only change with broad agreement – without it, you get a separate chain, but not a new Bitcoin. Background: Forks & controversies.

COLDCARD: firmware bug weakened seeds

On 30 July 2026, the manufacturer Coinkite warned of a firmware bug in its COLDCARDProvider · Hardware walletCOLDCARDBitcoin-only signing device from Coinkite (Canada) with an air gap via microSD, NFC and QR – more for advanced users.Hardware manufacturer – no financial licence required · reviewed Sept 2026Price: Q $319, Mk5 $219 (promotional prices, as of Sept 2026)On the learning path: Stage 6 · Step 1 – Hardware wallets compared →Our profile →Official website ↗Only buy hardware wallets from the manufacturer or an authorised reseller.×-brand hardware walletsGlossaryHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally. The key never leaves the device, so malware on your computer can’t get at it.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →× and updated the warning on 1 August 2026. The bug weakened the randomness the devices use to generate the seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →×: on newer models, affected seeds had only about 72 instead of 128 bits of randomness. Attackers recomputed the keys offline and stole funds. Seeds generated on certain older firmware versions are affected.^[9]

What it means for you: Without a COLDCARD, you don’t need to do anything. With one, note that a firmware update does not fix a seed that has already been generated. The manufacturer advises anyone affected to create a new seed and move their funds.^[9] Which firmware versions are affected and how to move your funds is covered in the COLDCARD profile.

For every device: read security notices directly from the manufacturer and only install updates through official channels. More in Hardware wallets compared.

Mt. Gox: repayment deadline ends on 31 October 2026

The former Tokyo exchange Mt. GoxGlossaryMt. GoxA Japanese Bitcoin exchange that collapsed in February 2014. Around 850,000 BTC were missing; just under 200,000 turned up again. Since July 2024, the trustee has also been repaying creditors in bitcoin; the current deadline is 31 October 2026.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× is still being wound up; a trustee is repaying creditors, partly in bitcoin. On 27 October 2025, the trustee postponed the repayment deadline to 31 October 2026 (Japan time) – the third one-year extension since the original 2023 deadline.^[10]

What it means for you: This only affects you directly if you are a creditor. The trustee warns of fake websites and emails in its name.^[10] For everyone else, the case shows that a balance on a platform is a claim against a company, and winding one up can take many years. More in Understanding custody.

Bottom line: what you can do now

Where next?