Bull Bitcoin is taking France’s highest administrative court to seek the annulment of DAC8, a new European law that puts millions of users at physical risk.
Bull Bitcoin, the world’s oldest Bitcoin-only and non-custodial exchange, has filed a legal challenge before the Conseil d’État, France’s supreme administrative court, seeking to annul the country’s implementing decree for DAC8, a sweeping European financial surveillance directive. Alongside the legal action, the company has launched dac8.com, a publicly accessible resource compiling official sources, legal analysis, and policy documentation for citizens, journalists and policymakers, available in French, English and other European languages.
The challenge targets Decree No. 2025-1276, the principal measure transposing the EU directive into French law.
What Is DAC8?
DAC8 (formally Directive (EU) 2023/2226) is the eighth amendment to the EU’s framework for administrative cooperation in tax matters. Since January 1, 2026, it requires crypto-asset service providers, including those based outside the EU if they serve European residents, to report client identities and the details of their transactions to their national tax authority. That data is then transmitted automatically to the tax administration of the member state where the customer lives.
In practice, platforms must transmit a user’s full identity—name, tax identification number, country of residence—along with a detailed history of all transactions: purchases, sales, exchanges, transfers, and yield-generating activities like staking and lending. The first batch of reports covering the 2026 calendar year is due to national authorities by January 31, 2027, with cross-border exchanges between member states expected to follow by September 2027.
DAC8 is the EU’s implementation of CARF, the Crypto-Asset Reporting Framework developed by the Organisation for Economic Co-operation and Development (OECD)—the international body of wealthy nations—following a 2021 G20 mandate.
Bull Bitcoin’s Case
Bull Bitcoin, founded in 2013 by Francis Pouliot and recently licensed under the EU’s MiCA regulation, argues that DAC8 creates a centralized honeypot of sensitive personal data that will inevitably be breached, placing millions of ordinary crypto holders at physical risk.
“DAC8 has transformed the concept of Know Your Customer into Kill Your Customer,” said Pouliot in a statement.
The company is not opposed to KYC per se. As a regulated exchange operating in Canada, Europe and Mexico, Bull Bitcoin already collects and stores client data as required by law. Its objection is to the aggregation and mandatory cross-border sharing of that data far beyond what tax enforcement plausibly requires.
“We cannot let the very foundations of civilization be shattered by this attack on privacy rights,” added Pouliot. “We must draw a line in the sand and refuse to cede any more territory before we have nothing left. Someone must take a stand. It appears that no one else is willing and able to do so. Therefore, it falls to Bull Bitcoin to lead this fight.”
The company filed a summary petition before the Conseil d’État on February 24, followed by a full substantive brief. It has stated its intention to pursue further action before the European Court of Justice and France’s constitutional court if necessary, and to challenge the global counterpart directive, CARF, through whatever legal avenues are available.
A Security Crisis in Plain Sight
The lawsuit arrives against a backdrop of a documented and worsening physical threat to crypto holders in France—one that makes the case for the dangers of centralized crypto data more concrete than theoretical.
Just last week, French Interior Minister Laurent Nuñez said authorities have recorded 77 verified cases of kidnapping, abduction, extortion, or attempted extortion linked to the crypto sector since the beginning of 2026. That figure already exceeds the approximately 45 cases documented across all of 2025.
France currently accounts for an estimated 70% of all documented “wrench attacks” worldwide—a term used in the security research community to describe the use of physical coercion, rather than hacking, to steal digital assets from victims.
Several cases have been traced back directly to data breaches at French cryptocurrency platforms. A 2025 breach at Waltio, a crypto tax reporting tool, exposed sensitive information belonging to roughly 50,000 users, and hackers later claimed through dark web forums that the stolen data was linked to at least three kidnappings.
The threat has also implicated public officials. In 2025, a French tax official named Ghalia C. was charged with using government tax software to look up the addresses and assets of cryptocurrency investors and selling the information to organized crime networks.
High-profile incidents include the kidnapping and mutilation of Ledger co-founder David Balland, a home invasion targeting Binance France’s CEO, and the abduction of a magistrate and her mother for a crypto ransom. Earlier this year, the wife of Sandbox co-founder Sébastien Borget narrowly escaped an attempted kidnapping.
| Bull Bitcoin is on the mission to Destroy Fiat. Engineering Sovereignty and allowing you to Own Your Money, Bull Bitcoin makes Bitcoin the money of the future—starting today. |
The Proportionality Argument
At its legal core, Bull Bitcoin’s challenge is framed around proportionality—a foundational principle of European human rights law that requires any interference with fundamental rights, including privacy, to be no greater than what is strictly necessary to achieve a legitimate aim.
The company argues that DAC8 goes well beyond what tax enforcement requires. It mandates the collection and transmission of transaction data regardless of whether those transactions have any connection to taxable events, pulling in routine transfers between wallets, for instance, that carry no tax implications whatsoever. The resulting database, shared across every EU member state and potentially beyond under CARF, creates exposure far out of proportion to the stated goal of closing crypto tax gaps.
Bull Bitcoin says a successful ruling in France could set a legal precedent and serve as a blueprint for challenges in other EU member states.
The Counterargument
Supporters of DAC8 argue that it brings crypto in line with how traditional financial accounts have been treated for years under existing information-sharing frameworks, and that the tax compliance case is legitimate. The directive targets exchanges, staking services, lending platforms, and yield-generating products, but carves out central bank digital currencies and certain limited-use tokens.
It is also worth noting that DAC8’s reporting obligations fall on platforms, not individuals, and that the data collected is subject to existing European data protection law under the GDPR. Whether those protections are sufficient—or whether the sheer scale of aggregated crypto data creates risks GDPR was not designed to address—is precisely the question Bull Bitcoin is asking the courts to answer.
The company has made clear it is financing the legal proceedings independently, without seeking industry partners or lobby support. Bull Bitcoin, which describes itself as self-funded since its founding, has never raised outside capital or taken on debt.