France has become the world’s crypto kidnapping capital. Organized crime syndicates use leaked government databases of user identities and balances - mandated by the EU’s DAC8 directive - to select targets for physical attacks. Bull Bitcoin CEO Francis Pouliot cited 150 to 180 expected kidnappings in 2026 alone.
On TFTC, Pouliot argued DAC8 transforms the concept of 'Know Your Customer' into 'Kill Your Customer.' The directive forces exchanges to hand over granular user data to the state, which then shares it across 27 countries. Corrupt officials in France have already been convicted for selling these lists to gangs.
"DAC8 creates a mandatory pan-European database of all crypto user identities and transaction details, shifting from KYC’s selective reporting to mass surveillance."
- Francis Pouliot, TFTC: A Bitcoin Podcast
Bull Bitcoin is now suing the French government to annul the directive. The firm argues the state already has tools to investigate tax evasion and doesn't need a pan-European database of every citizen’s wealth. The lawsuit, filed before France’s supreme administrative court, challenges DAC8 on grounds of proportionality and violations of the EU Charter.
The next day, on Rabbit Hole Recap, hosts Marty Bent and Matt Odell framed the suit as a three-pronged fight: building privacy tools like PayJoin, using them to break surveillance heuristics, and litigating against overreach. Pouliot secured Bull Bitcoin’s regulatory license before filing to ensure standing to fight from within the system.
This legal battle represents a strategic pivot. Writing code is no longer sufficient defense when the state mandates corporate complicity. If the French challenge fails, Pouliot plans to take the fight to the European Court of Justice.
The broader regulatory clash is accelerating. On Bitcoin And, David Bennett noted that the OECD’s Crypto Asset Reporting Framework (CARF) is set for implementation in Canada this year and in the US by 2028 or 2029. Pouliot views current KYC as less invasive, requiring data only for warranted police investigations, unlike DAC8’s automatic annual data dump to tax authorities.
"France expects 150-180 crypto kidnappings in 2026, averaging one every 2.5 days in Q1, fueled by leaked government data sold by convicted bureaucrats to criminal gangs."
- Francis Pouliot, TFTC: A Bitcoin Podcast
The industry’s typical compliance - cuckoldry, as Pouliot calls it - cheers for regulations like MiCA to build moats against smaller competitors, often smuggling in expanded surveillance. Bull Bitcoin’s lawsuit is a refusal to cede more ground to unelected, supranational bureaucrats. It’s a line in the sand drawn before privacy becomes illegal by default.
