Bull Bitcoin has just crossed an unprecedented legal threshold in Europe. The Bitcoin-only exchange, recently granted MiCA approval by the AMF, has filed a challenge before the Council of State seeking to annul the primary decree transposing the European DAC8 directive into French law.
Behind this legal challenge lies a very concrete physical security concern: France is one of the countries most affected by violent attacks targeting cryptocurrency holders. And according to Bull Bitcoin, DAC8 only makes the problem worse.
A head-on confrontation between a Bitcoin industry player and the French state — one that could redefine the rules of the game for millions of crypto users across Europe.
DAC8: The European Directive Turning Exchanges Into Massive Data Repositories
The DAC8 directive requires crypto asset service providers (CASPs) to collect, centralize, and transmit the personal and financial data of their users to European tax authorities. In France, this transposition materialized as Decree No. 2025-1276, which Bull Bitcoin is directly challenging before the country’s highest administrative court.
The exchange’s central argument is as much technical as it is security-driven: by forcing platforms to aggregate massive volumes of data on crypto holders, DAC8 creates what cybersecurity experts call a “honey pot” — a prime target for hackers and organized crime. Unlike a standard corporate database, this multinational framework multiplies potential entry points, making any robust security guarantee virtually impossible to deliver.
Bull Bitcoin also highlights a regulatory paradox: by making regulated exchanges more dangerous to use, DAC8 mechanically pushes users toward unregulated alternatives — peer-to-peer trading, home mining, offshore platforms. The result is that the very tax collection the directive is meant to improve could actually deteriorate.
France: The European Epicenter of Violent Attacks on Crypto Holders
Bull Bitcoin’s legal challenge is grounded in a documented and alarming reality. According to data from Gart, a firm specializing in the protection of crypto users, France has the second-highest rate of physical attacks targeting cryptocurrency holders in the world — behind the United States, whose population is nevertheless five times larger.
Recent cases speak for themselves: the CEO of Binance France, David Prinçay, was targeted, as was David Balland, co-founder of Ledger, who lost a finger during his kidnapping. These are not isolated incidents. Jameson Lopp, co-founder of Casa, has been documenting “wrench attacks” for years in a public database on GitHub, and the trend is clearly accelerating.
The criminal logic is straightforward: users who declare their crypto assets to tax authorities inadvertently prove that they hold them. If that data leaks — through a hack, a regulatory vulnerability, or internal corruption — it becomes a directory for criminal organizations. Bitcoin and cryptocurrencies being irreversible and instantly transferable across borders, the risk profile is radically different from that of a standard bank account.
dac8.com and Bull Bitcoin’s Strategy: Legal, Educational, and Political
Alongside its challenge before the Council of State, Bull Bitcoin is launching dac8.com, a fully sourced public resource aimed at citizens, journalists, and policymakers. The goal is clear: to bring this debate out of technical circles and turn it into a mainstream societal issue.
The approach is strategic. Bull Bitcoin, as a MiCA-approved exchange regulated by the AMF, cannot be accused of trying to dodge regulation. On the contrary, the company is playing the full compliance card while contesting the specific implementation measures it considers dangerous for its users. It is a legally sound position that draws a clear line between the substance (the issue of mass surveillance) and the form (the tax reporting obligation itself).
Should the Council of State act on this challenge, the implications extend well beyond France: an annulment of the transposition decree could establish European case law on the compatibility of DAC8 with fundamental rights — privacy, personal safety, and the proportionality of measures. A precedent that Brussels will not be able to ignore.
