Bull Bitcoin asks French court to strike down DAC8 implementing decree
Key Takeaways
- Bull Bitcoin has petitioned France’s Council of State (Conseil d’État) to annul Decree No. 2025-1276, the French implementing measure for the EU’s DAC8 crypto tax reporting directive, according to Cointelegraph.
- The non-custodial Bitcoin exchange argues the decree could build a “mass database” tying identity, home addresses and transaction records for up to 135 million European crypto holders, per Cointelegraph.
- Cointelegraph reports that cybersecurity firm CertiK recorded 19 confirmed wrench attacks in France during 2025, while French broadcaster RTL reported that French police counted 41 crypto-related kidnappings since the start of 2026, separate figures that together illustrate the physical-security concerns underlying the case.
What Bull Bitcoin Is Challenging
Bull Bitcoin, a non-custodial Bitcoin exchange, has taken formal legal action in France against a decree implementing DAC8, the European Union’s directive requiring crypto service providers to collect and automatically report user identity and transaction data to national tax authorities, according to Cointelegraph. Those authorities then share the data with counterparts across other EU member states.
Cointelegraph reports that DAC8 took effect on Jan. 1, 2026, and that France enacted its implementing rules through Decree No. 2025-1276, signed on Dec. 19, 2025. According to Cointelegraph, Bull Bitcoin filed a summary petition with the Conseil d’État on Feb. 24, followed by a more detailed legal brief laying out its substantive arguments.
The exchange has said it plans to pursue every legitimate legal route to suspend, delay, annul or amend both DAC8 and its international equivalent, the Crypto-Asset Reporting Framework (CARF), which Cointelegraph describes as a global standard developed by the Organisation for Economic Co-operation and Development (OECD) for exchanging crypto transaction data between jurisdictions.
The core of Bull Bitcoin’s objection, as reported by Cointelegraph, is that DAC8’s reporting requirements go well beyond what is needed for tax purposes. The exchange contends the rules risk creating a centralized repository linking legal identities and home addresses to crypto holdings, including data on transactions that have no bearing on tax liability. Cointelegraph notes that under the directive, crypto service providers must submit their first reports covering the 2026 calendar year by Sept. 30, 2027, after which EU tax authorities will begin automatically exchanging that information among themselves.
Why Physical Safety Concerns Are Central to the Case
Bull Bitcoin’s petition leans heavily on the argument that aggregating identity and address data tied to crypto holdings could expose individuals to real-world danger, not just privacy intrusion. Cointelegraph reports the exchange pointed to a climate of frequent data leaks combined with a rise in kidnappings targeting crypto holders as evidence that such a database would put the physical safety of millions of people and their families at risk.
This concern is grounded in documented trends rather than speculation, though the figures come from distinct sources and timeframes. Cointelegraph cites cybersecurity firm CertiK’s finding that so-called wrench attacks, in which victims are threatened or physically assaulted to force them to hand over digital assets, rose by 75% in 2025, reaching 72 verified cases worldwide. France recorded the highest number of these incidents of any country during 2025, with 19 confirmed cases, while Europe as a whole accounted for roughly 40% of global incidents, according to Cointelegraph.
Separately, Cointelegraph reports that RTL cited French police figures counting 41 crypto-related kidnappings since the start of 2026, a more recent and broader category than CertiK’s 2025 wrench-attack tally. Bull Bitcoin’s warning also follows major crypto firms suffering customer data breaches. Cointelegraph notes that in May 2025, Coinbase said less than 1% of its transacting monthly users were affected in an attack that may cost the exchange up to $400 million in reimbursement expenses. Taken together, these episodes form the backdrop against which Bull Bitcoin argues that centralizing identity and address data under DAC8 poses risks beyond conventional privacy concerns.
Hype Check
Claim: DAC8 will create a single centralized European database exposing up to 135 million crypto holders to physical danger.
Reality: Cointelegraph reports that Bull Bitcoin, not an EU regulator, is the source of the 135 million figure and the “mass database” characterization, framed as part of its legal argument before the Conseil d’État. DAC8 requires crypto service providers to report identity and transaction data to national tax authorities for automatic exchange across the EU, with first reports due by Sept. 30, 2027. Whether this constitutes a single unified “database” or how it will be secured has not been independently verified in the reporting, and the case remains pending before the French court.
Verdict: Partly substantiated. The legal challenge, the decree, and the documented rise in wrench attacks and kidnappings are confirmed by Cointelegraph’s reporting, but the scale and severity of the “mass database” risk reflect Bull Bitcoin’s legal framing rather than an independently confirmed outcome. This is not financial advice.
Source
Researched with AI assistance, fact-checked and edited by a human. Not financial advice.