France’s DAC8 crypto reporting rules aren’t just a tax compliance measure. Bull Bitcoin CEO Francis Pouliot calls them a kidnapping factory.
The directive forces exchanges to annually dump detailed client data - names, addresses, balances - into a central database shared across all 27 EU member states. Pouliot argues this shift from targeted police warrants to wholesale surveillance creates a massive attack surface for criminals. In France, corrupt officials have already been convicted of selling crypto user lists to gangs. On TFTC, Pouliot cited France as the “crypto kidnapping capital of the world,” with 150 to 180 kidnappings projected for 2026 alone.
“DAC8 transforms the concept of ‘Know Your Customer’ into ‘Kill Your Customer.’ The directive exposes not just the holders, but their families and children.”
- Francis Pouliot, Bitcoin And
The database itself is insecure. The French national agency for secure credentials suffered a breach in early 2026, exposing up to 19 million accounts. Similar large-scale breaches have plagued the US, including Equifax in 2017 and the National Public Data breach in 2024. Bull Bitcoin filed a legal challenge last week in France’s supreme administrative court to annul the directive, arguing the state’s inability to protect mandated data collection violates proportionality and human rights.
The broader crypto industry is unprepared for this fight. Pouliot contends many firms, like Coinbase, cheer for regulation as a competitive moat, even when those laws smuggle in expanded surveillance powers. Bull Bitcoin is pivoting from writing privacy code to constitutional lawsuits. On Rabbit Hole Recap, Matt Odell framed it as a three-pronged strategy: build tools, use them, litigate. If courts fail, jurisdictional competition remains the final lever.
“These centralized databases are honeypots for criminal gangs. In France, past leaks of tax data have already led to targeted kidnappings and home invasions.”
- Marty Bent & Matt Odell, Rabbit Hole Recap
The battle is one front in a global regulatory push. The OECD’s Crypto Asset Reporting Framework (CARF), mandated by the G20, is set for implementation in Canada this year and in the US by 2028 or 2029. Europe is acting first. The legal challenge in France aims to repeal, delay, or mitigate DAC8 before it becomes the template exported worldwide.
