France is the crypto kidnapping capital of the world, and the European Union is building the directory.
On TFTC, Francis Pouliot argued the DAC8 directive mandates a mandatory pan-European database of all crypto user identities and transaction details, shifting from KYC’s selective reporting for warranted investigations to annual, automatic data dumps to tax authorities. The database becomes an attack surface. Corrupt French officials have already been convicted for selling crypto user lists to gangs. Pouliot cited 150 to 180 expected kidnappings in 2026 alone.
"France expects 150-180 crypto kidnappings in 2026, averaging one every 2.5 days in Q1, fueled by leaked government data sold by convicted bureaucrats to criminal gangs."
- Francis Pouliot, TFTC: A Bitcoin Podcast
Bull Bitcoin secured its French regulatory license before filing its suit against the government. The strategy, discussed on Rabbit Hole Recap, ensures the exchange can fight from within the system, challenging DAC8 on proportionality and EU Charter violations. Pouliot aims to repeal it, delay it, or mitigate its harm.
On Bitcoin And, David Bennett highlighted the physical stakes. He noted France ranks as the second-most dangerous epicenter for physical attacks on crypto users globally, with criminals targeting holders for non-reversible assets. Bennett cited a breach of the French national agency for secure credentials in early 2026, exposing up to 19 million accounts. When the state mandates collection of data it cannot protect, it draws a map for kidnappers.
"Bull Bitcoin CEO Francis Pouliot claims DAC8 transforms the concept of 'Know Your Customer' into 'Kill Your Customer.' The directive exposes not just the holders, but their families and children."
- David Bennett, Bitcoin And | Bitcoin & Economic News
The legal challenge represents a broader cypherpunk pivot. Pouliot told TFTC that writing code is no longer sufficient defense when the state mandates corporate complicity. The industry has a "cuckoldry" problem, where firms like Coinbase cheer for regulations to build moats, often smuggling in expanded surveillance. Bull Bitcoin’s move from privacy code to constitutional lawsuits marks a new line of defense.
The courts are the chosen battlefield. Pouliot believes challenging DAC8 through precedent and proportionality arguments is more effective than politics. If the French challenge fails, he plans to take the fight to the European Court of Justice. The goal is to break the heuristics of surveillance firms like Chainalysis, whose proprietary "common input ownership" assumptions create a "warrant factory" based on false positives.
The fight is three-pronged: build tools like PayJoin, use them, and litigate against overreach. If the courts fail, jurisdictional competition remains the last lever - move your business to a state that doesn't treat your financial history as public property.
