France is building a kidnapping factory, and Bull Bitcoin CEO Francis Pouliot is suing to shut it down. The DAC8 directive mandates that exchanges annually dump all user identities, addresses, and transaction histories into a centralized government database. Pouliot argues this creates a target list for criminals - one that is already leaking. Corrupt French officials have been convicted for selling crypto user lists to gangs, fueling an expected 150 to 180 kidnappings this year.
On TFTC: A Bitcoin Podcast, Pouliot described France as the 'crypto kidnapping capital of the world.' The state’s own systems are porous; a breach at the French national agency for secure credentials in early 2026 exposed 19 million accounts. When the government collects data it cannot protect, it draws a map for kidnappers. DAC8 shifts from targeted 'Know Your Customer' to mass surveillance - Pouliot calls it transforming KYC into 'Kill Your Customer.'
“The DAC8 directive forces exchanges to hand over user identities and balances to the state, which then shares that data across 27 EU countries. This creates a massive attack surface for criminals.”
- Francis Pouliot, TFTC: A Bitcoin Podcast
Bull Bitcoin secured its French regulatory license before filing its lawsuit at the supreme administrative court, a strategic move to fight from within the system. The suit challenges DAC8 on proportionality and human rights grounds, arguing the state already has tools for tax investigations and doesn’t need a pan-European wealth database. If the French court fails, Pouliot plans to escalate to the European Court of Justice.
The fight extends beyond privacy to the faulty evidence underpinning prosecution. Pouliot argues third-party surveillance firms like Chainalysis sell 'black box' analysis based on flawed heuristics, which courts treat as DNA evidence. His strategy includes promoting PayJoin to break these heuristics, creating grounds to challenge surveillance data in court.
Meanwhile, European regulators are panicking over a different threat. On Bitcoin And, David Bennett noted the EU is frantically revising its MiCA rulebook to block US dollar-pegged stablecoins. Trump’s embrace of dollar tokens via the GENIUS Act has unsettled central bankers, who fear a massive drain of deposits from European banks. The revision process will likely drag into 2027.
“When the state mandates the collection of data it cannot protect, it effectively draws a map for kidnappers.”
- David Bennett, Bitcoin And | Bitcoin & Economic News
The legal battle marks a pivot from writing privacy code to constitutional lawsuits. Pouliot views litigation as a more effective tool than politics, citing precedents and a multi-angle strategy. He urges other firms to find their line in the sand before privacy becomes illegal by default.
