Bull Bitcoin challenges France's DAC8 decree, citing risks for 135M holders

Bull Bitcoin on Wednesday petitioned France's Council of State to strike down a decree implementing the European Union's DAC8 tax reporting rules, arguing the mass surveillance database endangers up to 135 million European crypto holders.

"Against a backdrop of daily data leaks and a surge in kidnappings targeting crypto-asset holders, building such a database endangers the physical safety of millions of holders and their loved ones," Bull Bitcoin said in a press release.

DAC8, which took effect Jan. 1, requires crypto service providers to collect user identity and transaction data and automatically report it to national tax authorities, which then share the information across EU member states. France implemented the rules through Decree No. 2025-1276, signed Dec. 19. Bull Bitcoin filed a summary petition on Feb. 24 and a substantive legal brief outlining its arguments. The exchange said it will pursue every avenue to suspend or annul DAC8 and its global counterpart, the OECD's Crypto-Asset Reporting Framework.

The challenge comes as France has become a hotspot for so-called wrench attacks — physical assaults to force crypto transfers. French police counted 41 crypto-related kidnappings since January, according to an April RTL report. Wrench attacks rose 75% in 2025 to 72 verified cases globally, with France recording 19 incidents, per CertiK. A data breach at Coinbase in May 2025 affected less than 1% of its monthly transacting users and may cost the exchange up to $400 million in reimbursements.

Under DAC8, crypto service providers must submit their first reports covering the 2026 calendar year by Sept. 30, 2027, after which tax authorities across EU member states will automatically exchange the information. Bull Bitcoin argues the rules sweep in transactions with no tax relevance, creating a permanent link between legal identities and wallet addresses.

The legal challenge adds to a growing debate over whether the EU's regulatory framework strikes the right balance between transparency and user safety. The European Securities and Markets Authority this week launched a separate review of crypto custody providers' operational resilience under MiCA, signaling increased scrutiny of how platforms safeguard user assets.

Industry groups have warned that mandatory data collection could drive users toward unregulated peer-to-peer channels, undermining the transparency goals regulators seek. Bull Bitcoin, a non-custodial exchange, said it filed the action to protect the physical safety of holders at a time when on-chain transparency already exposes transaction histories to anyone with blockchain analytics tools.

The Council of State has not set a hearing date. If the petition succeeds, it could delay or block DAC8 implementation in France and set a precedent for other EU member states.

This article is for informational purposes only and does not constitute investment advice.