Crypto Showdown: Bull Bitcoin Launches Landmark Legal Battle Against French Surveillance Rules

Bull Bitcoin, the world's oldest Bitcoin-only and non-custodial exchange, recently licensed under MiCA by France’s financial markets regulator AMF, has launched a significant legal challenge in French courts against the European DAC8 directive. The company has filed before the Conseil d’État, France’s supreme administrative court, seeking to annul Decree No. 2025-1276. This decree, which transposes the DAC8 directive into French law, is argued by Bull Bitcoin to create a massive surveillance grid and database. This system, they contend, cannot be adequately secured from leaks and data hacks, thereby exposing millions of crypto users and their families to risks of kidnapping and physical harm. In conjunction with this legal action, Bull Bitcoin has made dac8.com publicly available as "a complete, fully sourced resource for citizens, journalists and policymakers."

The urgency of Bull Bitcoin's challenge is underscored by a concerning rise in kidnappings and physical attacks targeting crypto users, predominantly in Europe, with France identified as an epicenter. Organized crime groups are reportedly exploiting lax data reporting laws, which inadvertently expose law-abiding crypto users' asset ownership. Given the irreversible and easily transferable nature of Bitcoin and other cryptocurrencies, criminals are increasingly targeting these individuals. According to Gart, a company specializing in user protection, France ranks second only to the USA in physical attacks on crypto users, despite its smaller population. High-profile figures within the crypto industry, such as Binance France CEO David Prinçay and Ledger co-founder David Balland, who suffered a severe injury, have been victims. Jameson Lopp, co-founder of Casa, has documented this accelerating trend of 'wrench attacks' in a GitHub database for years. Bull Bitcoin's legal challenge asserts that further consolidation and sharing of crypto user data under DAC8 will only exacerbate this dangerous trend.

Bull Bitcoin critically argues that DAC8 transforms a company's natural incentive to protect user data into a perilous "honey pot" – a valuable, multinational database with numerous entry points. Cybersecurity experts have long warned against such centralized data repositories. While regulated crypto-asset service providers (CASPs) under MiCA, DORA, and GDPR operate with supervision and financial incentives to safeguard customer data, DAC8, conversely, shifts this data into administrative reporting networks. These networks offer broader access and significantly reduce user accountability, making it harder for individuals to assess who has access to their information. Bull Bitcoin concludes that the security of this entire system will ultimately be "only as strong as its weakest link."

Historical evidence strongly supports the difficulty of maintaining data security when large datasets are amassed. Recent incidents in France include a major breach detected on April 15, 2026, at the French National Agency for Secure Credentials (ANTS, or France Titres), which exposed data from 11.7 to 19 million accounts, including login IDs, names, emails, dates of birth, and, in some cases, postal addresses and phone numbers. Months prior, the French National Bank account registry also suffered a hack, compromising data for approximately 1.2 million accounts, including IBANs and account holder names. The United States has seen similar, large-scale breaches, such as the 2017 Equifax data breach affecting 147 million Americans, the 2024 National Public Data Breach impacting over 200 million with leaked social security numbers, and the 2015 breach of the U.S. Office of Personal Management, which compromised medical records and social security numbers of government officials. These incidents demonstrate that consolidating user information into such "honeypots" inevitably puts civilians at risk from both physical attacks and identity-theft related fraud.

Perhaps the most alarming concern highlighted by Bull Bitcoin on the DAC8 website is the risk posed to individuals who have never even purchased cryptocurrency, simply due to familial association with a crypto user. Citing data from Certik, Bull Bitcoin emphasizes that over half of the violent incidents recorded in 2026 against crypto owners specifically targeted a family member—be it a spouse, child, or elderly parent—either as a direct victim or as leverage against the key holder. Bull Bitcoin asserts that "DAC8 therefore exposes not only crypto-asset holders, but their entire close family circle: between 40 and 135 million Europeans fall into a physical-risk zone, without any of them ever having consented." Francis Pouliot, CEO of Bull Bitcoin, views this overreach into European privacy as potentially catastrophic for the continent’s prosperity. He unequivocally stated in a press release that "DAC8 has transformed the concept of Know Your Customer into Kill Your Customer," adding, "We cannot let the very foundations of civilization be shattered by this attack on privacy rights. We must draw a line in the sand and refuse to cede any more territory before we have nothing left. Someone must take a stand. It appears that no one else is willing and able to do so. Therefore, it falls to BULL to lead this fight."

Beyond the direct security risks, Bull Bitcoin also contends that DAC8's regulations may counteract their stated intentions. They argue that users, driven by personal security concerns, will likely seek legal alternatives to centralized, regulated exchanges. This could lead to an increase in off-the-grid transactions via peer-to-peer exchanges, home mining, or offshore unregulated platforms, ultimately making tax collection even more challenging. The dac8.com website offers a wealth of facts, figures, official sources (including EUR-Lex, OECD, and Legifrance), and analysis in multiple languages for public review and use.