Bitcoin Privacy

Crypto Tax Compliance: Privacy and Reporting

A hand draws one blank report sheet from a charcoal records folio while other pages remain inside.

This guide shows how to report your bitcoin for tax without giving away more privacy than you must. Exchanges hand you a history you can import, but coins in your own wallets, peer-to-peer purchases and Lightning payments reach your tax records only if you document them yourself. Tax software then works out your cost basis (what you paid for each coin) and your gains and losses, and produces the forms your tax authority needs.

The privacy risk is in how you feed that software. Give it your wallet’s extended public key (xpub) and it can work out every address the wallet has used and every one it will use, which permanently ties your identity to all of that bitcoin. That matters most for bitcoin bought without KYC (the identity checks exchanges run). Below are an eight-step yearly workflow, safer ways to import your wallets, five common mistakes, and answers on gifts, CoinJoin and what to keep for an audit.

Step-by-Step Guide

The eight steps below are a typical holder’s yearly routine, with US forms as the example; the same steps work in most countries.

Three kinds of record feed your tax software. Exchange exports cover trades, deposits, withdrawals and earnings on that exchange, but stop where your coins leave it. Your wallet's export covers every on-chain move in and out of your own wallets, but doesn't know what you paid. Your own notes cover peer-to-peer purchases and Lightning payments, with the date, the amount in BTC, the value and the purpose, and fill the gaps the other two leave. The software merges them into one ledger. Then: 1 check for missing cost basis, duplicate imports and wrong prices; 2 file, with disposals on Form 8949 and Schedule D and income on Schedule 1 in the US; 3 archive, encrypted and in two copies, keeping each purchase record until years after you sell.
No single record covers your year. An exchange’s export ends where your coins leave it, and your wallet’s export doesn’t know what you paid. Your own notes fill those gaps. The software merges all three; the checks come before you file.

Step 1: Gather all exchange transaction histories. Log into every centralized exchange you used during the tax year and download complete CSV exports of trades, deposits, withdrawals, and earned income (staking rewards, referral bonuses, airdrops). Most exchanges provide a dedicated tax section or report download area. Save these files with clear filenames including the exchange name and date range.

Step 2: Export self-custody wallet transaction records. For hardware wallets and software wallets, export the transaction history via your wallet software (Sparrow, Electrum, Ledger Wallet, formerly Ledger Live). If your wallet connects to your own node, the export captures only local data and maintains privacy. If you must use a third-party service, understand that providing an xpub exposes your entire address history — consider using watch-only wallets loaded with individual addresses instead of xpubs when possible.

You paste your wallet's xpub, a read-only key that can't spend, into a tax tool. From it the tool calculates every receiving address and every change address in the wallet: the ones already used, whose coins and history it sees, and the ones not used yet, which it sees as soon as coins arrive. The company keeps all this with your account, linking your email address to your whole wallet. An xpub can't spend, but it shows your whole wallet, and you can't take it back.
An xpub shows a tax tool your whole wallet. From that one read-only key, software calculates every receiving and change address your wallet has used or will use. Tax companies’ records can leak: in January 2026 Waltio, a French crypto tax service, leaked users’ email addresses with figures from their 2024 tax reports, in many cases gains, losses and year-end balances.

Step 3: Document all peer-to-peer and DeFi transactions. Transactions on decentralized exchanges, DeFi protocols, peer-to-peer platforms (Bisq, HodlHodl, RoboSats), and Lightning Network channels often do not appear in exchange reports. Record these manually with: date, amount in BTC, amount in fiat at the time, counterparty type, and purpose (purchase, sale, swap, payment). If you kept the transaction IDs, you can check on-chain transactions on a block explorer. A public explorer sees which transactions you look up, so use your own node’s explorer or Tor Browser (see network privacy).

Step 4: Select and configure tax calculation software. Choose a crypto tax tool that supports your transaction types and jurisdictions. Common options include Koinly, CoinTracker, and Bitcoin.tax. Import your exchange CSVs and manually-prepared records. Before connecting wallets, review the tool’s privacy policy regarding data retention, xpub handling, and third-party sharing. Consider running the software locally if a self-hosted option is available.

Three ways to give a tax tool your wallet's history, each shown against a row of eight addresses, five used and three not used yet. Paste your xpub: the company sees every address, even the ones not used yet. Add single addresses, as a watch-only wallet, or import a CSV file of transactions from your wallet app: it sees what you hand over, but not your next addresses. Do the sums yourself, with local software and your own node: no company sees anything. Your tax return still reports every gain; this choice decides what a company keeps.
Give a tax company only what it needs. Your xpub hands over every address, even the ones you haven’t used yet, and the company can keep watching. Single addresses or a file of transactions show those transactions, plus anything the public blockchain links to them, but not your next addresses. Doing the sums on your own computer shows a company nothing.

Step 5: Assign cost basis methods and verify calculations. Select the cost basis method your jurisdiction allows. In the US, FIFO (first in, first out) is the default, counted wallet by wallet since 1 January 2025. Choosing which coins you sell instead, for example the costliest first (HIFO) or the newest first (LIFO), counts as specific identification: you must record which coins you are selling no later than each sale, so you can’t switch to it when you file. For coins on an exchange you normally tell the exchange, though through 31 December 2026 your own records also count (how the method changes your gain). Review the software’s computed gains and losses for each disposal event. Check for common errors: missing cost basis (which causes the software to treat the full sale amount as gain), duplicate transactions from overlapping CSV imports, and incorrect fiat pricing on illiquid trading pairs.

Example: you buy 0.01 BTC for $300 on exchange A, withdraw it to your own wallet, then deposit it on exchange B and sell it for $800. Exchange A's records show the $300 you paid, but that price doesn't travel with the coins: exchange B's report shows the $800 but no cost basis. If your tax software has the purchase record, $800 minus $300 is a $500 gain. If it doesn't, it treats the cost as $0 and counts the whole $800 as gain, $300 too much. In the US, an exchange's Form 1099-DA has to show cost basis only for coins bought there since 2026 and never moved out; for coins you moved in, you supply it from your own records.
A missing purchase record turns the whole sale into gain. When coins move between exchanges and wallets, the price you paid stays in the first exchange’s records. For coins bought peer to peer, it lives only in your own notes.

Step 6: Identify and apply loss harvesting opportunities. If you hold positions that are currently at a loss, check whether your jurisdiction’s wash sale rules apply to cryptocurrency. Where permitted, selling a losing position and repurchasing creates a realized loss that offsets gains. In the United States the wash sale rule (Internal Revenue Code section 1091) covers only stock and securities, and its text does not mention digital assets; bills that would extend it to crypto have been proposed, so verify the current year’s rules in your jurisdiction before executing this strategy.

Step 7: Generate and review tax forms. Export the completed tax reports in the format your tax authority requires. In the US, disposals go on Form 8949 and Schedule D, and staking, mining or airdrop income on Schedule 1 (Schedule C if it is business income). Review every line item for accuracy: correct dates, proceeds, cost basis, and gain/loss amounts. Cross-reference the total net gain against your own records to ensure the software has not omitted or double-counted transactions.

Step 8: Securely archive all records. Tax authorities in most jurisdictions can audit returns for 3-7 years after filing. Keep the record of each purchase for as long as you hold those coins, and then until the return for the year you sell them can no longer be audited: seven years after the sale is a safe margin. Store all exchange exports, wallet transaction histories, manual records, and the final tax software output in an encrypted archive. Keep both a local copy and an encrypted cloud backup. Include notes explaining any unusual transactions, DeFi interactions, or cross-chain swaps that might require clarification during an audit.

Common Mistakes to Avoid

1. Sharing your xpub with every tax tool and service. An extended public key (xpub) allows the recipient to derive every address your wallet has ever used or will use, exposing your full balance and transaction history. Once shared, this information cannot be un-disclosed. Limit xpub exposure to tools you have thoroughly vetted, and prefer importing individual transaction records or using watch-only wallets with specific addresses instead.

2. Forgetting to report Lightning Network transactions. Lightning payments are taxable events in most jurisdictions just like on-chain transactions. If you paid for goods or services with Lightning, each payment is a disposal that triggers a capital gain or loss calculation based on your cost basis in the spent Bitcoin. Keep logs from your Lightning wallet with the date, amount in BTC, value in fiat at the time, and purpose of every payment, including small ones.

3. Using the wrong cost basis for non-KYC Bitcoin. Bitcoin acquired through peer-to-peer trades, mining, or CoinJoin outputs still has a cost basis — it is the fair market value when you received it (for mining or airdrops), the actual purchase price (for P2P trades), or, where a CoinJoin counts as no sale (see the FAQ below), the cost basis of the coins you put in. Failing to establish and document cost basis results in tax software treating the entire sale amount as profit. Keep receipts, screenshots, or contemporaneous records of every acquisition.

4. Overlooking taxable events in DeFi interactions. Wrapping Bitcoin (WBTC), providing liquidity, and earning yield in DeFi protocols may each constitute separate taxable events depending on your jurisdiction. In the US, swapping one digital asset for another is a disposal, so trading BTC for WBTC counts as one even though you intend to hold the same economic exposure. Consult a tax professional familiar with cryptocurrency to determine which DeFi actions create taxable events in your specific jurisdiction.

5. Failing to file because the tax situation seems too complex. Non-filing carries penalties that exceed any potential savings from underreporting. If your transaction history is complex, start with the records you have, use tax software to generate a best-effort calculation, and file on time. You can amend the return later if you discover errors. Consider working with a CPA experienced in cryptocurrency taxation for complex portfolios involving multiple DeFi protocols or cross-border holdings.

Frequently Asked Questions

Do I owe taxes if I only held Bitcoin and never sold?

In most jurisdictions, holding Bitcoin without selling, exchanging, or spending it does not create a taxable event. Unrealized gains (your Bitcoin increasing in value while you hold it) are not taxed until you dispose of the asset. However, receiving Bitcoin as payment for goods or services is taxable as income at the fair market value on the date received, even if you continue holding it. Similarly, mining rewards and staking income are typically taxed as ordinary income upon receipt.

How do I handle the cost basis for Bitcoin I received as a gift?

In the United States, the recipient of a Bitcoin gift assumes the donor’s cost basis (adjusted for any gift tax the donor paid) and holding period, as long as they can be documented. If the donor paid $20,000 for 0.5 BTC and gifted it to you, your cost basis is $20,000 and your holding period includes the donor’s time. If the fair market value at the time of the gift is less than the donor’s cost basis, special rules apply for calculating losses. Ask the donor for proof of the purchase price and date: without it, the IRS treats your basis as zero and your holding period starts the day after the gift.

Are CoinJoin transactions taxable events?

CoinJoin itself is a privacy technique that combines your transaction with others to break chain analysis, not an exchange of different assets. In principle, you receive back the same amount of bitcoin minus the fees, so the mix itself realizes no capital gain or loss. The fees depend on which CoinJoin tool you use: mining fees always, plus an entry, coordinator or maker fee with some. Those fees are paid in bitcoin, and under US rules paying a fee in bitcoin is itself a disposal of those sats, usually a tiny one; elsewhere fees may be deductible or added to your cost basis, depending on how your jurisdiction treats transaction costs. Keep records of all CoinJoin fees paid as part of your overall cost basis documentation.

What records should I keep for a potential audit?

Maintain exchange trade histories, wallet export CSVs, on-chain transaction IDs with timestamps, records of the fiat value at the time of each acquisition and disposal, receipts from peer-to-peer purchases, mining or staking income records, and the final tax software output showing your calculations. Store these in an encrypted archive for at least 7 years after you file, and keep the record of each purchase until 7 years after you sell those coins. If you used DeFi protocols, keep screenshots or logs of smart contract interactions, as these records may be difficult to reconstruct later.

Related Resources

Filed under: Bitcoin Privacy
← Back to All Articles