A non-custodial Bitcoin exchange taking the French government to its highest administrative court over a tax reporting directive might sound like a long shot. But Bull Bitcoin’s legal challenge against the EU’s DAC8 crypto tax reporting framework is grounded in something far more visceral than regulatory disagreement — it’s about whether collecting and centralizing data on millions of crypto holders could get people killed.
Summary
Key takeaways
- Bull Bitcoin filed a petition before the French Conseil d’État on February 24, 2026, to annul Decree No. 2025-1276, the French implementing measure for DAC8.
- DAC8 requires crypto service providers to collect user identity and transaction data and report it automatically to national tax authorities, with first reports due by September 30, 2027.
- France recorded 41 crypto-related kidnappings since the start of 2026 and 19 confirmed wrench attacks in 2025 — the highest count in Europe.
- Wrench attacks increased by 75% globally in 2025, reaching 72 verified cases worldwide, according to CertiK.
- Bull Bitcoin says it will pursue every legitimate avenue to suspend, delay, annul, or amend both DAC8 and its global counterpart, the CARF.
Bull Bitcoin’s Legal Challenge Against DAC8 Implementation
The physical threat to crypto holders in France is not theoretical. French police had counted 41 crypto-related kidnappings since the start of 2026, according to a report by RTL. Against that backdrop, Bull Bitcoin’s argument takes on a different weight: any regulation that creates a centralized, comprehensive database linking Bitcoin holders to their legal identities and home addresses is not just a privacy concern — it is, the company argues, a safety emergency.
Filing the Petition at the Conseil d’État
On February 24, 2026, Bull Bitcoin filed a summary petition before France’s Conseil d’État, the country’s supreme administrative court, seeking to annul the decree that brought DAC8 into French law. That was followed by a substantive legal brief laying out the full arguments. The target is Decree No. 2025-1276, signed on December 19, 2025, which is how France chose to implement the EU-wide directive at a national level.
The exchange has been explicit about its ambitions: it intends to use “every legitimate avenue to suspend, delay, annul or amend the effects of DAC8 and its global counterpart, the CARF” — the Crypto-Asset Reporting Framework developed by the Organisation for Economic Co-operation and Development as a common global standard for collecting and exchanging information on crypto transactions.
What Bull Bitcoin Is Actually Arguing
The core of the legal case rests on a concern that DAC8 risks creating what Bull Bitcoin describes as a mass database linking users’ legal identities and home addresses to their crypto activity — including transactions with no relevance to taxation whatsoever. The exchange warns that, set against a backdrop of daily data leaks and an accelerating wave of physical attacks targeting crypto holders, building such a database puts millions of people and their families in danger.
It is a striking argument to make in a court filing. Rather than purely technical legal objections, Bull Bitcoin is essentially asking the Conseil d’État to weigh the physical safety consequences of regulatory data collection — a framing that reflects just how seriously the wrench-attack crisis in France has escalated.
Overview of DAC8 Crypto Tax Reporting Rules
DAC8 is the EU’s eighth iteration of the Directive on Administrative Cooperation. For crypto, the stakes are significant: it requires all crypto service providers operating within the EU to collect user identity and transaction data and automatically report it to national tax authorities, which then share the information with counterparts across all EU member states. The directive came into force on January 1, 2026.
What Crypto Service Providers Must Do
Under the new rules, every covered provider must begin tracking and recording user data for the full 2026 calendar year. The first set of reports — covering all of 2026 — must be submitted to national tax authorities by September 30, 2027. From there, the information flows automatically between EU member states, creating a pan-European picture of crypto activity tied to individual identities.
The scope is broad. The reporting requirement is not limited to transactions flagged for tax purposes — it covers data across the board, which is precisely the point Bull Bitcoin is contesting. When a regulation captures far more than it needs to achieve its stated goal, the excess data becomes a liability.
France’s Implementation Timeline
France moved quickly to transpose the directive. Decree No. 2025-1276 was signed on December 19, 2025, just days before the January 1, 2026 effective date, giving French crypto firms very little runway to prepare. That speed, and the breadth of data collection it mandated, sits at the center of Bull Bitcoin’s legal challenge.
Privacy and Safety Concerns for Crypto Users in France
The data security and physical safety dimensions of DAC8 are where the debate becomes most urgent. Major crypto firms have already demonstrated that centralized user data is a target. In May 2025, Coinbase disclosed that a cyberattack affected a portion of its monthly transacting users — an incident that may cost the exchange up to $400 million in reimbursement expenses. If a database as comprehensive as the one DAC8 would create were ever breached, the consequences for individual holders could extend well beyond financial loss.
The Surge in Wrench Attacks Targeting Crypto Holders
The numbers around physical attacks on crypto holders have become impossible to ignore. According to cybersecurity firm CertiK, wrench attacks — where victims are threatened or physically assaulted to force transfers of digital assets — increased by 75% in 2025, reaching 72 verified cases worldwide. France was the worst-affected country in Europe, recording 19 confirmed wrench attacks in 2025 alone, with Europe accounting for roughly 40% of all global incidents that year.
By 2026, the situation had deteriorated further. RTL reported that French police counted 41 crypto-related kidnappings since the start of the year. That figure gives concrete weight to Bull Bitcoin’s argument: criminals already target crypto holders when they can identify them. A government-mandated database tying identities to holdings and addresses could, if compromised, function as a ready-made target list.
The Broader Implication: When Tax Compliance Becomes a Security Risk
There is a tension at the heart of DAC8 that the legal challenge forces into the open. Tax authorities have legitimate interests in tracking crypto transactions to prevent evasion. But the architecture required to serve that interest — a centralized, identity-linked, cross-border database of crypto activity — creates a honeypot of exactly the kind of information that criminal actors, from sophisticated hackers to opportunistic kidnappers, are actively seeking.
Bull Bitcoin’s petition does not argue that tax reporting is inherently wrong. It argues that the specific mechanism France and the EU have chosen to implement it creates disproportionate risks for ordinary holders, particularly in a country where the threat of physical attack on crypto owners is now statistically significant. Whether the Conseil d’État finds that argument legally sufficient to annul Decree No. 2025-1276 is an open question — but the case puts on record that crypto data privacy in France is no longer just a civil liberties concern. It is, by any reasonable measure, a public safety one too.
FAQ
What is Bull Bitcoin’s main concern regarding the DAC8 implementation in France?
Bull Bitcoin is concerned that DAC8 could lead to a mass database linking user identities and home addresses to crypto activity, endangering the physical safety of holders and their families — particularly given the sharp rise in kidnappings and wrench attacks targeting crypto owners in France.
When did the DAC8 directive come into effect and what does it require?
DAC8 came into effect on January 1, 2026. It requires crypto service providers to collect user identity and transaction data and automatically report it to national tax authorities, which then share the information across EU member states. First reports covering the 2026 calendar year are due by September 30, 2027.
How has France been affected by wrench attacks on crypto holders?
France experienced 19 confirmed wrench attacks in 2025 — the highest count in Europe — and French police recorded 41 crypto-related kidnappings since the start of 2026. Globally, wrench attacks rose by 75% in 2025 to 72 verified cases, according to CertiK, with Europe accounting for roughly 40% of all incidents.
What legal actions has Bull Bitcoin taken against DAC8 in France?
Bull Bitcoin filed a summary petition with the French Conseil d’État on February 24, 2026, targeting Decree No. 2025-1276 — the national measure implementing DAC8 — and followed it with a substantive legal brief. The exchange has stated it will pursue every legitimate avenue to suspend, delay, annul, or amend the effects of both DAC8 and the OECD’s global Crypto-Asset Reporting Framework (CARF).
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
