Bull Bitcoin vs. France: The Lawsuit Against DAC8 Surveillance
On February 24, 2026, a bitcoin exchange quietly petitioned France's highest administrative court to strike down a surveillance law. This week the fight went public: Bull Bitcoin — a Bitcoin-only, non-custodial exchange regulated in France under the EU's MiCA framework — filed its full legal brief asking the Conseil d'État to annul Decree No. 2025-1276, the decree that transposes the EU's DAC8 crypto reporting directive into French national law. It is believed to be the first legal challenge to DAC8 to reach a European court, and it was brought not by an anonymous privacy activist but by a licensed exchange suing the same state that regulates it.
What DAC8 actually does
DAC8 — formally Directive (EU) 2023/2226 — is the eighth amendment to the EU's Directive on Administrative Cooperation, adopted in October 2023. Since January 1, 2026, it requires every crypto-asset service provider operating in the EU to collect and report its users' identities, home addresses, tax numbers, and transaction histories to national tax authorities. Those authorities then exchange the data automatically across all 27 member states.
Two words in that sentence deserve emphasis. Automatically: no suspicion of wrongdoing is required. If you bought €50 of bitcoin on a regulated platform, your name, home address, and transaction record flow into the system alongside everyone else's. And every: DAC8 is the EU's implementation of the OECD's Crypto-Asset Reporting Framework (CARF), which dozens of jurisdictions have committed to adopt, with the first international data exchanges expected in 2027. The United States is running its own version of the same play — custodial brokers there began issuing Form 1099-DA for transactions starting in 2025.
The honey pot argument
Bull Bitcoin's core claim is simple: this framework builds a target list. Twenty-seven interlinked government databases recording who owns bitcoin, how much they've moved, and where they sleep at night.
The filing points to the April 2026 breach of France Titres, which exposed data tied to roughly 19 million accounts, as proof that the French state cannot secure the sensitive data it already holds. And the case lands in a country that has become ground zero for so-called wrench attacks — physical robberies and kidnappings targeting known crypto holders. Bull Bitcoin counts 41 crypto-related kidnappings in France since January 2026 alone. That follows the January 2025 abduction of Ledger co-founder David Balland, whose captors severed his finger while demanding a crypto ransom, and a string of attempted kidnappings in Paris later that year.
Security researcher Jameson Lopp has maintained a public list of known physical attacks on bitcoin holders for years, and the trend line is not subtle: as the price rises, so do the attacks. Many victims appear to have been identified through leaks, hacks, and loose talk — not blockchain forensics. A state-mandated registry of holders, complete with home addresses, is exactly the kind of dataset that turns a leak into a target list.
Why a regulated exchange is suing its regulator
Bull Bitcoin is an odd plaintiff, and that is what makes this case interesting. This is not an offshore operation dodging compliance. The Canadian-born company is regulated under MiCA in France and runs one of the oldest Bitcoin-only, non-custodial exchanges in the world: when you buy sats, they settle straight to a wallet you control. The company never holds customer funds.
That architecture is the point. Bull Bitcoin built its business on the idea that an exchange shouldn't custody your coins — and now it is arguing, in court, that the state shouldn't custody your identity either. Alongside the brief it launched dac8.com, a public portal laying out its objections, and it has said the Conseil d'État petition is only the opening move in a longer campaign against both DAC8 and CARF through "every legitimate avenue."
Why this matters outside France
If the Conseil d'État refers the case's questions to the Court of Justice of the European Union, the challenge could test whether blanket financial surveillance is proportionate under EU privacy law — and a ruling there would bind all 27 member states, not just France. There is precedent for optimism: the CJEU struck down the EU's indiscriminate data-retention regime in 2014 on exactly those grounds.
And if you're reading this from the US, don't file it under someone else's problem. CARF-style reporting is the global direction of travel. The question this lawsuit puts on the table — should governments compile permanent registries of who holds bitcoin? — is coming to every jurisdiction that hasn't answered it yet. Someone had to be first to say no in court.
What you can actually do
You can't opt out of the law, but you can shrink your exposure:
- Hold your own keys. Coins left on an exchange are an entry in someone else's database twice over — the company's and, increasingly, the government's. Withdraw to a wallet you control.
- Minimize your KYC surface. Every platform holding your passport scan is a future leak. Use fewer platforms, close dormant accounts, and ask providers to delete data they no longer need.
- Keep quiet about your stack. Wrench attacks start with information. Don't post balances, don't flex gains, and think about what ships to your home address under your real name.
- Add friction for attackers. A passphrase-protected hardware wallet or a multisig setup means a leaked name and address doesn't map to instantly spendable coins.
One honest note to close. Yes, we sell bitcoin apparel while telling you to stay quiet about your stack — the difference is that a shirt signals culture, not custody. It says you chose Bitcoin; it says nothing about how much you hold or where it lives. If this case has you double-checking where your keys sleep, you're already our kind of person. BitCloset makes heavyweight apparel for people who opted out on purpose.