Bull Bitcoin Sues France Over DAC8, Calling EU Crypto Surveillance Directive a Data Breach Waiting to Happen

Bull BBTC$62,395.00▼0.59% has filed a legal challenge before France’s Conseil d’État to annul the French decree implementing DAC8, the EU’s crypto tax-reporting directive, arguing that the sweeping data collection it mandates far exceeds what tax enforcement requires and creates a concentrated, demonstrably leakable target for criminals — including those willing to physically attack crypto holders.

The challenge, confirmed by both a Reddit post and a Bitcoin Magazine report, targets the proportionality of the directive itself. Under DAC8, crypto platforms must report users’ full identity — home address, date of birth, tax residence — and complete transaction history. Every acquisition, disposal, transfer, deposit, and withdrawal. Including transactions with no tax relevance whatsoever. Banks, operating under existing EU frameworks, report only annual balance and interest earned — a far narrower data set that serves an analogous fiscal purpose.

The European Commission’s own DAC8 page describes the directive as aimed at strengthening automatic exchange of information to fight tax fraud and evasion. Bull Bitcoin’s legal argument attacks the gap between that stated goal and the data actually collected. If the objective is catching tax evasion, the challenge asks, why mandate a full transaction-level history including non-taxable events? Why collect home addresses when balances would suffice? Proportionality is the legal hinge.

A Federated Database Across 27 Jurisdictions

Then there is the scale problem. DAC8 data will be shared across all 27 EU member-state tax administrations, creating a single federated database that the Reddit post’s author claims could be potentially 1,000 times larger than existing single-platform databases. More data, more administrators with access, more jurisdictions with varying security standards — and a far bigger payoff for anyone who can breach or simply buy their way in.

The track record of European government databases is not reassuring. A DGFiP agent in Bobigny was jailed in January 2026 for selling home addresses and tax profiles to criminals, specifically targeting cryptocurrency investors. No hack required — just a corrupt official with database access and a willing buyer. Italy’s “Equalize” case, running from 2024 through 2026, saw corrupt police officers exfiltrate over one million records from tax, police, and bank databases for resale and blackmail. Bulgaria’s tax authority suffered a breach exposing data on 5 to 7 million citizens — nearly its entire adult population — using what investigators called basic techniques. France’s privacy regulator logged 8,613 breach notifications in the last 12 months, roughly one per hour. More than 100 million French citizen records were compromised in 18 months from state-run or state-contracted databases.

From Data Breach to Physical Attack

The Waltio breach makes the crypto-specific danger concrete. Waltio, a French crypto tax platform, was breached — and that breach directly preceded at least three kidnappings, according to French authorities. The same category of database DAC8 would create, but at far greater scale and with the force of law behind its collection.

Physical attacks on crypto holders are not theoretical. Wrench attacks — physical coercion to extract crypto — rose 75% in 2025 and a further 41% in Q1 2026 compared to Q1 2025. Europe accounts for 82% of global crypto-related physical attacks. France alone accounts for 70% of them. Over half of 2026 victims held no crypto themselves; they were spouses, children, or elderly parents of holders. $101 million was extorted in just the first four months of 2026. A database that maps every crypto holder’s home address to their full transaction history is, in this environment, not a tax tool. It is a target list.

What the Conseil d’État Will Decide

The legal challenge at the Conseil d’État will test whether French courts accept the proportionality argument — whether the directive’s data collection can be justified against its stated tax-enforcement purpose, or whether it overreaches in ways that violate protections against excessive surveillance and foreseeable harm. The French decree implementing DAC8 is the immediate target, but the argument is structured to resonate across EU jurisdictions where the directive is being transposed into national law.

The broader market context: total crypto capitalisation sits at $2.21 trillion, down 1.2% over 24 hours, with the Fear and Greed Index at 22 — Extreme Fear. Bitcoin trades at $61,780, down 1.89% on the day. EETH$1,741.10▼0.82% sits at $1,725, off 2.03%. None of those numbers are driving the legal challenge, but they frame the political environment — a market in fear, a regulatory apparatus expanding its surveillance reach, and a physical-attack epidemic concentrated in the very country whose courts will now hear the case.

The Conseil d’État has not yet set a hearing date. Bull Bitcoin’s filing requests annulment of the French decree and, by extension, a legal precedent that could complicate DAC8’s implementation across the EU. The next concrete signal to watch: whether the court grants a suspension of the decree pending review, a decision that would determine whether crypto platforms operating in France must begin collecting and reporting the full DAC8 data set while the challenge works its way through.